## TL;DR
SPF allows at most 10 DNS lookups while evaluating a record; nested includes blow past it and receivers treat the result as a permanent error. Flatten the record to direct IPs, drop stale includes, and stay under the limit.

```text
spf permerror too many dns lookups 10 lookup limit exceeded
```

## Use this when
- Receivers report SPF permerror or 'too many DNS lookups'.
- SPF shows none or permerror even though the TXT record exists.
- You added a new mail vendor and SPF broke the same day.

## Not for this skill when
- SPF fail, meaning the IP is not in the record.
- DKIM signature failures.
- DMARC alignment problems on forwarded mail.

## Steps
1. Pull the current TXT record and count lookups: every include, a, mx, ptr, and redirect counts. Verify: you have a written count above 10.
2. Identify which vendors still send for you; remove includes for dead tools. Verify: the remaining include list matches active vendors only.
3. Ask big vendors for their dedicated IP ranges and replace the include with ip4 entries. Verify: the lookup count drops under 10 with margin.
4. Flatten anything still nested, keeping the record under 255 characters per string. Verify: a DNS query returns the full record intact.
5. Test with a mail-tester service or an actual send to Gmail and check headers. Verify: Authentication-Results shows spf=pass.

## Variant phrasings
### spf too many dns lookups permerror
Common phrasing of the error.
### spf 10 lookup limit exceeded fix
The limit-angle search.
### spf permerror flatten includes
The fix-angle search.

Compatibility: Any DNS provider and any sender; the 10-lookup limit is in the SPF spec (RFC 7208).

## Why it happens
SPF was designed with a lookup cap to stop DNS amplification attacks. Every include pulls in another record, and vendor records include their own vendors, so three includes can silently become fourteen.

## Edge cases / pitfalls
- The count includes lookups from nested includes; audit recursively, not just your own line.
- Flattened records go stale when a vendor changes IPs; re-check quarterly.
- Multiple TXT records starting with v=spf1 at the same name break everything; keep exactly one.
- Macros in SPF count against the limit too; keep the record simple.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KLoGg8xpUS4bsHaYS9GABQ