Will mail with 4.7.24 be delivered eventually?

Usually yes. It is a temporary DNS error, and the sending server retries until DNS answers or the queue lifetime runs out.

How do I find which include breaks the limit?

Expand each include recursively and add up the lookups; the ProbeKit SPF check shows the count per include.

5.7.24 bounce: SPF validation error

5.7.24SPF validation errorPermanent: retrying will not help

Typical wording

550 5.7.24 SPF validation error

What it means

X.7.24 in RFC 7372 is “SPF validation error”: the receiver tried to evaluate SPF and got an error, not a pass or fail. SPF (RFC 7208) knows two such results. Permerror means the record itself is broken; temperror means a DNS lookup failed for the moment.

The class digit follows that split. A permerror is reported as 5.7.24, because the record will stay broken until someone edits it. A temperror is reported as 4.7.24 (RFC 7372 suggests 451), and the sending MTA keeps the message queued and retries.

Contrast 5.7.23, where SPF ran correctly and said fail. With 5.7.24 the record never produced a clean verdict, so the fix is DNS hygiene rather than adding IPs.

Likely causes

More than 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect), which makes SPF return permerror.
Two separate TXT records starting with `v=spf1` on the same name.
Syntax errors such as a misspelled mechanism, a missing colon after ip4, or an include pointing at a domain with no SPF.
Slow or failing authoritative nameservers, which cause temperror and a 4.7.24 deferral.

How to fix it

Look up the SPF record of the envelope sender domain and make sure exactly one `v=spf1` record exists.
Count lookups across nested includes and bring the total to 10 or fewer by removing unused services or replacing includes with ip4/ip6 ranges you control.
Correct syntax errors and check every include target has its own valid SPF record.
For temperror, test your nameservers for timeouts and lame delegation; the queued mail will go through once DNS answers reliably.

Checks that apply

Your domain or sending IP (fills in the checks below)

SPF Check Parses the record, follows includes, counts lookups and reports permerror conditions, the main source of 5.7.24.
DNS Server Audit Audits your nameservers for timeouts and inconsistencies, which explain a temporary 4.7.24.
SPF Generator Helps you rebuild a single, valid record that stays under the lookup limit.

FAQ

Will mail with 4.7.24 be delivered eventually?: Usually yes. It is a temporary DNS error, and the sending server retries until DNS answers or the queue lifetime runs out.
How do I find which include breaks the limit?: Expand each include recursively and add up the lookups; the ProbeKit SPF check shows the count per include.

All 191 bounce codes