SPF has a limit almost nobody hits on purpose and plenty of people hit by accident: a receiver is allowed to make ten DNS lookups while evaluating your record, and if the chain needs an eleventh it returns permerror and throws your entire SPF away. Not the eleventh mechanism — the whole record. Your carefully maintained list of authorised senders stops meaning anything, and nothing anywhere tells you. Counting those ten looks like a five-line function. I wrote it, wrote unit tests for it,...