SPF

The version section is exactly v=spf1, ended by a space or by the end of the record. A version of v=spf10 does not match and is discarded.

After that discard, no remaining record means the result none. More than one remaining record means permerror. A syntax error anywhere in the record also returns permerror immediately, before the terms are evaluated.

include, a, mx, ptr, exists, and redirect cause DNS queries. Implementations must limit the total number of those terms to 10 during evaluation. Over the limit, the result is permerror.

all, ip4, ip6, and exp do not cause a DNS query at evaluation time. They are not subject to the limit. The exp modifier may query later, and that later query is outside this count.

A void lookup is a query that returns an empty answer or a name error. Implementations should limit those to two. The limit may be configurable, and the recommended default is two. Exceeding it produces permerror.

That is a second counter. It is not a free pass, and it is not the same counter as the 10.

Permerror means the published records could not be correctly interpreted, and a DNS operator has to change them. A temperror is a transient DNS error. A later retry may succeed without a DNS change.

If the message is rejected during SMTP because of permerror, the reply should be 550 and, where supported, enhanced status 5.5.2. A temperror rejection should be 451 and, where supported, 4.4.3.