What the checker does
It reads the TXT records of the domain you enter and picks out the one that starts with v=spf1. Then it follows every include and redirect the way a receiving server would, records each lookup that costs a DNS query, and checks every term for syntax.
There is no IP address involved. The question here is whether the record is valid and affordable for anybody who has to evaluate it, not whether one particular server may send. For that, send a message through the full test and the report shows the result the receiver actually got.
Too many DNS lookups: the limit of ten
RFC 7208 caps an SPF evaluation at ten terms that need a DNS query: include, a, mx, ptr, exists and redirect. The count runs across the whole tree, so an include that itself includes three more uses four of them. Go over the limit and the result is permerror, which DMARC counts as SPF not passing.
The checker counts every term, including the ones evaluation might never reach, because a real evaluation stops at the first match. Servers listed early keep passing and the ones further down start failing, and from the outside that looks like mail that works for some messages and not others.
Ip4 and ip6 terms cost nothing. Replacing includes with address ranges (flattening) brings the count down, at the price of keeping those ranges in step with your providers by hand.
Mistakes worth looking for
Two SPF records on one domain. It happens when a second provider's setup guide says to add a record and nobody merges it into the first. Two records are a permerror on their own.
An ending of +all, which lets any server on the internet pass, or ?all, which says nothing about anyone and so protects nothing. A ptr term, which RFC 7208 says not to use. Includes for services the company stopped using years ago still cost a lookup each.
Questions
What does an SPF record look like?
It is one TXT record on the domain that starts with v=spf1, lists who may send and ends in a rule for everyone else. v=spf1 include:_spf.google.com ip4:203.0.113.5 ~all lets Google Workspace and one server send and softfails the rest. A domain may publish only one.
SPF softfail or hardfail: ~all or -all?
Once DMARC is in place either works, because DMARC decides what happens to a message that fails. ~all (softfail) is the safer choice while you are still finding every service that sends for you. Switch to -all when the DMARC reports show nothing legitimate failing.
Why does my record pass in the full test but show more than ten lookups here?
The receiver stopped evaluating at the first term that matched your server, so it never paid for the rest. Another server further down the list would push the same evaluation past ten and fail.
What is a void lookup?
A DNS query that returns no records or a name that does not exist. RFC 7208 lets an evaluation have two of them; a third is a permerror. Includes for domains that no longer exist are the usual cause.
Can a domain have two SPF records?
No. RFC 7208 allows one record that starts with v=spf1, and with two of them every evaluation ends in permerror. Merge them: keep a single v=spf1, put the include and ip4 terms of both into it and end with one all. v=spf1 include:_spf.google.com include:servers.mcsv.net ~all covers two providers in one record.
Full guide: Multiple SPF records
What does SPF permerror mean?
Permanent error: the record cannot be evaluated as published, so trying again gives the same result. The usual causes are more than ten DNS lookups, two SPF records on one domain, a syntax error and a third void lookup. DMARC counts a permerror as SPF not passing.
Full guide: SPF permerror: too many DNS lookups
What if no SPF record is found?
Receivers get the result none, which DMARC treats the same as a fail, and anyone can put your domain in the envelope sender. Publish one TXT record on the domain itself that starts with v=spf1, lists the services that send for you and ends in ~all or -all.