What SPF does
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send mail for it. When a message arrives, the receiver looks up the record for the envelope sender's domain and checks whether the sending server is on the list.
v=spf1 include:_spf.example.net ip4:192.0.2.0/24 -all- include: also allow the servers in another domain's SPF record, usually your mail provider's.
- ip4: / ip6: allow an address or a range directly.
- a / mx: allow the servers your domain's A or MX records point to.
- -all / ~all: what to do with everything else: fail, or soft-fail.
The 10-lookup limit
To keep checks fast, a receiver may do at most 10 DNS lookups while evaluating SPF, counting everything inside your includes. Each email service you add usually brings one include, and some providers' includes contain several more. Go over the limit and SPF fails for all of your mail, not just the newest service. The tree above shows where your lookups go, so you can see which include to remove or replace.
SPF is not enough by itself
SPF checks the envelope sender, not the From address people see, and it breaks when mail is forwarded. That is why it works together with DKIM signatures and a DMARC policy. Check those with the DKIM lookup and the DMARC checker, or read how the three fit together.
Questions
What counts towards the 10-lookup limit?
Every include, a, mx, ptr and exists mechanism and the redirect modifier, including the ones inside records you include. ip4, ip6 and all cost nothing. Over 10, receivers stop and return a permanent error, which counts as an SPF failure for all your mail.
Should I end with -all or ~all?
-all asks receivers to reject mail from servers you did not list; ~all asks them to treat it as suspicious. With an enforced DMARC policy the practical difference is small, and ~all is a safer choice while you are still finding every service that sends for you.
Can I have two SPF records?
No. A domain must have exactly one TXT record starting with v=spf1. With two, receivers return a permanent error. Merge the mechanisms from both into one record.
How do I get under the lookup limit?
Remove includes for services you no longer use, replace a and mx with the ip4 or ip6 addresses they point to when those are stable, and send newsletters from a subdomain with its own SPF record. Flattening every include into IP addresses works too, but breaks silently when a provider changes its ranges.