Are you seeing complaints about your domain's email being refused for DMARC validation failures? Do you use multiple MTA service providers to send email? Does your TXT record in DNS for SPF include multiple mail service provide required "include:" entries? Please check the results of your records, drilling down through your includes, and included includes until the end, and count how many " a " and " ptr " and " mx " and " exist " you have, as each of those counts as a lookup. Each include adds one. Each include's include counts as another, on and on. Total up all your lookup and see if your SPF requires the receiving server to perform more than 10 lookup including the original for your domain, then review:

RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1

I hope this helps someone out there!