Why Does the 10 DNS Lookup Limit Exist?
The SPF RFC specification restricts mail servers to 10 DNS queries during SPF evaluation to prevent denial-of-service (DoS) amplification attacks. If your SPF record contains multiple third-party marketing tools (e.g. Google Workspace + HubSpot + SendGrid + Zendesk), you will quickly hit 11+ lookups and receive a PermError, causing emails to drop.