Get SPF back under the 10-lookup limit

Flatten or consolidate includes so SPF stops returning permerror.

30 min

why this matters

Receivers stop after 10 DNS lookups and return permerror. Every message then fails SPF, no matter how correct the rest of the record is.

1
Count your real lookups
Each include, redirect, a, mx and ptr mechanism costs a lookup — and nested includes inside your providers' records count too. An SPF checker will show the full tree and the total.
2
Remove senders you no longer use
Old ESPs and abandoned tools are usually good for two or three lookups each. This is the cheapest fix.
3
Drop expensive mechanisms
Remove ptr entirely — it is deprecated and receivers ignore it. Replace a and mx with explicit ip4 ranges if those hosts don't send mail.
4
Flatten the stubborn includes
Replace an include with the ip4/ip6 ranges it resolves to, or use a hosted SPF-flattening service that keeps those ranges up to date for you. Never flatten by hand and forget it — provider IPs change.
```
v=spf1 ip4:203.0.113.0/24 ip4:198.51.100.0/24 include:_spf.google.com -all
```