SPF include mechanism

It asks the receiver to retrieve and evaluate another domain's SPF record as part of evaluating yours.

A match inside the included record counts as a match for yours. A non-match simply continues to the next mechanism.

It is not a redirect: evaluation returns to your record afterwards, and your own terminating qualifier still applies.

It is how every sending platform distributes its addresses — you include their domain, and they maintain the list behind it.

Which is also why your record's real cost is not visible from its own length.

The limit counts the whole expansion: your includes, their includes, and so on down the tree.

A provider restructuring its own record can add lookups to your total while your record is untouched.

So a configuration that worked for years starts failing on a day you deployed nothing, which is the confusing part of this failure.

Above ten lookups, receivers return a permanent error and stop evaluating — they do not use what they already retrieved.

Which means the failure is total rather than partial, and it removes one of the two ways a message can align under DMARC.

Remove includes for platforms the domain no longer uses, which on most records is where the first savings are.

Replace an include with explicit address mechanisms where the provider publishes a stable, small set — though that means maintaining it yourself when they change.

Use a dedicated subdomain for a platform that sends on your behalf, so its expansion is charged against that subdomain rather than your apex.

Consider a flattening service, understanding the trade: it resolves the tree into literal addresses on your behalf and now sits between you and every change your providers make.

Measure rather than estimate. The count is not obvious from reading the record, which is precisely why it surprises people.

Include, the address-of-domain mechanisms, the mail-exchanger mechanism and redirect all cost a lookup each.

Literal address ranges cost nothing, which is why they are the cheap way to authorise a server you control.

The deprecated reverse-lookup mechanism costs lookups and is unreliable enough that several receivers ignore it entirely.

Void lookups — those returning no answer — are separately capped, which is a second limit most people never encounter.

The terminating qualifier costs nothing and decides everything about what happens to unauthorised senders.

The include tree is expanded as it stands at query time and the lookups are counted against the limit.

The record is checked for uniqueness and for syntax, because several records or an unparseable one produce the same total failure as exceeding the budget.

The terminating qualifier is read, since a record comfortably under the limit that ends neutrally protects nothing.

The expansion reflects what providers publish at that moment, so a count near the limit is worth re-checking rather than assuming stable.