Your SPF record goes over the 10-lookup limit, so SPF fails for all your mail. Here is how to get it back under.
What the error means
SPF has a hard limit of 10 DNS lookups. Every include:, a, mx, exists and redirect= costs one, and so does every include hidden inside those includes. The SPF record syntax guide lists every part. Go over 10 and inboxes stop checking and return a “permerror”. SPF then fails for all your mail, including mail from services you listed.
You will see it as “too many DNS lookups”, “SPF PermError” or “exceeds the 10 DNS lookup limit” in a checker or in an email’s headers.
How to fix it
1
See what uses your lookups. Run your domain through the SPF checker. It shows each part of your record and how many lookups it costs, including the hidden ones.
2
Remove services you no longer use. Old newsletter tools, a helpdesk you left, a CRM trial. Each one you delete frees at least one lookup.
3
Drop a and mx if those servers don’t send. If your email goes through Google Workspace or Microsoft 365, your website and inbox servers usually don’t send mail themselves. Removing both saves two lookups.
4
Remove ptr. It is outdated, slow and officially discouraged.
5
Move bulk senders to a subdomain. Newsletters can send from news.yourdomain.com with their own SPF record, which has its own 10 lookups.
6
Still over? Flatten. Flattening swaps includes for the IP addresses behind them, which cost nothing. Do it with a service that updates automatically, because providers change their addresses without telling you.
A before and after
Before, 12 lookups:
v=spf1 a mx include:_spf.google.com include:sendgrid.net include:mailgun.org include:servers.mcsv.net include:mail.zendesk.com ~all
After removing a, mx and an unused Mailgun account (which alone used 5), 5 lookups: