SPF lets a domain list the services allowed to send mail for it. The catch is that a receiving server may have to follow several DNS references before it can decide. SPF has a hard limit of ten DNS-mechanism lookups during evaluation. Go over it and SPF can return a permanent error, even when every service in your record is legitimate.
What is happening
Count mechanisms that cause a lookup, such as include, a, mx, exists, redirect, and ptr. Plain IP addresses do not consume a lookup. Nested includes count too, which is why a record that looks short can still exceed the limit.
What to check first
Start by identifying every system that sends as your domain: mailbox provider, help desk, CRM, ecommerce platform, and any outbound tool. Remove services you no longer use, then ask the remaining vendors for their current SPF guidance. If the record still exceeds ten lookups, consolidate carefully with vendor-supported IP ranges or an SPF-flattening service, while remembering that vendor IPs can change.
A safer next step
Do not simply delete includes until the checker passes. That can cause valid mail to fail SPF. Make one documented change at a time, allow DNS to update, and test again.
Beacon can help you check the public email-authentication records for your domain. Run a free check before you make changes.