The SPF standard (RFC 7208) allows at most 10 DNS lookups while a receiver checks your record. Every include:, a, mx, ptr, exists: and redirect= costs one, and so does everything inside the records you include. Some providers nest further includes inside theirs, so a single include: can cost several lookups.
Symptoms
Over 10, SPF returns a permanent error (permerror) and passes nobody. DMARC then has to rely on DKIM alone, so a service that does not sign with DKIM for your domain starts failing, even though the record looks valid. An SPF record over the limit also lowers your security grade.
To see your count, run the free DMARC checker, or on the domain's page open Technical details, Run a check now, then Email authentication. Both show DNS Lookups out of 10.
Fix it at the source first
-
Remove services you no longer use. Old
include:entries are a common reason for going over the limit. -
Move bulk and marketing mail to a subdomain, such as
news.yourdomain.com, with its own SPF record and its own budget of 10 lookups.
Flattening, and why it goes stale
Flattening replaces include: chains with the IP addresses they currently resolve to, which costs few or no lookups. The catch is that you have taken a snapshot of someone else's infrastructure. When a provider adds sending addresses, your record no longer covers them, and that mail starts failing SPF.
Nothing re-checks a flattened record for you. If you flatten, redo it on a schedule you will actually keep, and again after any change to which services send as your domain.
Flattening can also change what a record means. Mechanisms with a qualifier, such as -include: or ~include:, and exists: mechanisms cannot become a fixed list of addresses without turning a deliberate fail into a pass, or failing mail the original allowed. A safe flattener refuses to change what your record means.
Our free SPF flattener works this way. It resolves your whole record, shows the true lookup count, and offers a record (or a short chain of records) to publish only when the result authorises exactly the same senders and stays within the limit. A Salesforce-style exists: term is kept as written and costs one lookup. If it cannot give you a faithful record, it tells you why. Keep a copy of your original record before you publish a flattened one: you will need it to flatten again later.