# SPF Flattening Services: How They Work and When to Use One *Published:* 2026-09-07 *Author:* Steven Jacob 💡 Quick answer - **What it does**SPF flattening swaps the include, a and mx terms in your Sender Policy Framework record for the IP addresses they resolve to, so receiving servers make fewer DNS lookups. - **Why it matters**SPF allows 10 DNS lookups per check. Go over and the check returns a permerror, so SPF stops passing for every sender on the domain, legitimate ones included. - **The catch**A flattened record is a snapshot. When a vendor changes its sending IPs, a stale copy starts failing real mail. - **Use a service when**You’re at 8 or more lookups, send through several SaaS platforms and have already removed the senders you don’t need. .bfa-tldr{background:#e8efee;border:1px solid rgba(68,112,110,.18);border-left:4px solid #44706E;border-radius:2px 14px 14px 2px;padding:22px 26px 20px;margin:0 0 30px;color:#0e1a1a;line-height:1.6} .bfa-tldr .bfa-label,.bfa-tldr p:first-of-type{font-size:12px;text-transform:uppercase;letter-spacing:.14em;font-weight:600;color:#44706E;margin:0;padding:0 0 13px;line-height:1.4;border-bottom:1px solid rgba(68,112,110,.28)} .bfa-tldr ul{margin:0;padding:0;list-style:none} .article-content .bfa-tldr li{list-style:none;display:grid;grid-template-columns:132px minmax(0,1fr);column-gap:20px;align-items:baseline;padding:14px 0;margin:0;font-size:15px;line-height:1.55;color:#4b5c5b;border-top:1px solid rgba(68,112,110,.22)} .article-content .bfa-tldr li:first-child{border-top:0} .article-content .bfa-tldr li:last-child{padding-bottom:0} .bfa-tldr li>span:only-child{grid-column:1/-1} .bfa-tldr li>strong:first-child{color:#1f3837;font-size:12.5px;letter-spacing:.055em;text-transform:uppercase;font-weight:700;line-height:1.5} .bfa-comparison{margin:34px 0;border:1px solid #e3e3e6;border-radius:16px;overflow-x:auto;box-shadow:0 1px 2px rgba(0,0,0,0.04)} .bfa-comparison table{width:100%;border-collapse:separate;border-spacing:0;font-size:15px;line-height:1.5} .bfa-comparison th,.bfa-comparison td{border:0;border-radius:0} .bfa-comparison thead th{background:#44706E;color:#ffffff;text-align:left;padding:15px 18px;font-size:11px;font-weight:700;letter-spacing:.12em;text-transform:uppercase;white-space:nowrap} .bfa-comparison td{padding:16px 18px;border-top:1px solid #e3e3e6;color:#4b5c5b;vertical-align:top} .bfa-comparison tbody tr:first-child td{border-top:0} .bfa-comparison td:first-child{background:#f9f9f9;font-weight:700;color:#1f3837} .bfa-comparison tbody tr:hover td{background:#e8efee} .bfa-key-takeaways{background:#ffffff;border:1px solid #e3e3e6;border-left:4px solid #44706E;border-radius:2px 16px 16px 2px;padding:24px 28px;margin:34px 0;box-shadow:0 1px 2px rgba(0,0,0,0.04)} .bfa-key-takeaways p:first-of-type{margin:0 0 4px;padding-bottom:14px;border-bottom:1px solid #e3e3e6;color:#44706E;font-size:11px;font-weight:700;letter-spacing:.14em;text-transform:uppercase} .bfa-key-takeaways ul{margin:0;padding:0;list-style:none} .article-content .bfa-key-takeaways li{display:grid;grid-template-columns:150px minmax(0,1fr);column-gap:22px;align-items:baseline;margin:0;padding:15px 0;list-style:none;border-top:1px solid #e3e3e6;color:#1f3837;font-size:16px;font-weight:400;line-height:1.55} .bfa-key-takeaways li:first-child{border-top:0} .bfa-key-takeaways li:last-child{padding-bottom:0} .bfa-key-takeaways li>span:only-child{grid-column:1/-1;font-weight:600} .bfa-key-takeaways li>strong:first-child{color:#44706E;font-size:12px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;line-height:1.5} .bfa-key-takeaways a{color:#44706E;text-decoration:underline;text-underline-offset:2px;text-decoration-thickness:1px} .bfa-checklist{background:#ffffff;border:1px solid #e3e3e6;border-left:4px solid #3f8d2a;border-radius:2px 16px 16px 2px;padding:24px 26px;margin:34px 0;box-shadow:0 1px 2px rgba(0,0,0,0.04)} .bfa-checklist p:first-of-type{margin:0 0 4px;padding-bottom:14px;border-bottom:1px solid #e3e3e6;color:#2a6b1c;font-size:11px;font-weight:700;letter-spacing:.14em;text-transform:uppercase} .bfa-checklist ul,.bfa-checklist ol{margin:0;padding:0;list-style:none} .article-content .bfa-checklist li{position:relative;margin:0;padding:13px 0 13px 34px;border-top:1px solid #e3e3e6;list-style:none;color:#4b5c5b;font-size:16px;line-height:1.55} .bfa-checklist li:first-child{border-top:0} .bfa-checklist li:last-child{padding-bottom:0} .bfa-checklist li::before{content:'\2713';position:absolute;left:0;top:13px;width:21px;height:21px;border-radius:50%;background:#e8f0e4;color:#2a6b1c;font-size:11px;font-weight:700;line-height:21px;text-align:center} .bfa-checklist strong{color:#1f3837} .bfa-steps{margin:34px 0;padding-left:0;list-style:none;counter-reset:bfastep} .bfa-steps li{counter-increment:bfastep;position:relative;padding:12px 16px 12px 52px;margin:0 0 10px;background:#f9f9f9;border:1px solid #e3e3e6;border-radius:12px;color:#0e1a1a} .bfa-steps li::before{content:counter(bfastep);position:absolute;left:14px;top:11px;width:26px;height:26px;border-radius:50%;background:#44706E;color:#ffffff;font-size:13px;font-weight:700;display:flex;align-items:center;justify-content:center} .bfa-steps li:last-child{margin-bottom:0} .bfa-callout{background:#f9f9f9;border:1px solid #e3e3e6;border-left:4px solid #a8642e;border-radius:2px 16px 16px 2px;padding:24px 28px;margin:34px 0;box-shadow:0 1px 2px rgba(0,0,0,0.04)} .bfa-callout p:first-of-type{margin:0 0 4px;padding-bottom:14px;border-bottom:1px solid #e3e3e6;color:#7a4a1f;font-size:11px;font-weight:700;letter-spacing:.14em;text-transform:uppercase} .bfa-callout ul,.bfa-callout ol{margin:0;padding:0;list-style:none;counter-reset:bfastep} .bfa-callout li{counter-increment:bfastep;position:relative;margin:0;padding:15px 0 15px 46px;border-top:1px solid #e3e3e6;color:#4b5c5b;font-size:16px;line-height:1.55} .bfa-callout li:first-child{border-top:0} .bfa-callout li:last-child{padding-bottom:0} .bfa-callout li::before{content:counter(bfastep);position:absolute;left:0;top:15px;width:26px;height:26px;border-radius:50%;background:#a8642e;color:#ffffff;font-size:12px;font-weight:700;line-height:26px;text-align:center} .bfa-callout li strong{color:#1f3837;font-weight:700} .bfa-callout a{color:#7a4a1f;text-decoration:underline;text-underline-offset:2px;text-decoration-thickness:1px} .bfa-bestfor{background:#e8efee;border-left:4px solid #3f8d2a;border-radius:0 12px 12px 0;padding:14px 20px;margin:18px 0 24px;color:#1f3837;font-weight:600;line-height:1.5} .bfa-screenshot{margin:26px 0} .bfa-screenshot img{width:100%;height:auto;display:block;border:1px solid #e3e3e6;border-radius:14px} .bfa-screenshot figcaption{margin-top:.6rem;font-size:.85rem;color:#728483;line-height:1.5;text-align:center} .bfa-illustration{margin:30px auto;text-align:center} .bfa-illustration img{max-width:min(400px,100%);max-height:400px;width:auto;height:auto;border-radius:14px;background:#ffffff} .bfa-illustration figcaption{color:#728483;font-size:13px;text-align:center;margin-top:12px} .bfa-faq{counter-reset:bfafaq;background:rgba(68,112,110,.04);border-radius:20px;padding:32px 36px;margin:34px 0} .bfa-faq h3,.bfa-faq h3.wp-block-heading{counter-increment:bfafaq;position:relative;margin:26px 0 0 52px;padding:26px 0 0;border-top:1px solid rgba(68,112,110,.12);color:#1f3837;font-size:19px;font-weight:700;line-height:1.4;text-wrap:balance} .bfa-faq h3:first-of-type,.bfa-faq h3.wp-block-heading:first-of-type{margin-top:0;padding-top:0;border-top:0} .bfa-faq h3::before{content:counter(bfafaq,decimal-leading-zero);position:absolute;left:-52px;top:26px;width:34px;height:27px;border-radius:8px;background:#ffffff;box-shadow:inset 0 0 0 1px rgba(68,112,110,.22);color:#44706E;font-size:12.5px;font-weight:800;line-height:27px;letter-spacing:.04em;text-align:center;font-variant-numeric:tabular-nums} .bfa-faq h3:first-of-type::before{top:0} .bfa-faq p{margin:10px 0 0 52px;color:#4b5c5b;font-size:17px;line-height:1.65;text-wrap:pretty} .bfa-pullquote{border-left:4px solid #a8642e;margin:30px 0;padding:6px 0 6px 22px;color:#1f3837;font-size:20px;line-height:1.45;font-style:italic} h3.wp-block-heading{font-size:18px;font-weight:700;line-height:1.4;margin-top:32px;margin-bottom:6px} @media(max-width:600px){ .bfa-tldr{padding:20px 18px} .article-content .bfa-tldr li{grid-template-columns:1fr;row-gap:5px} .bfa-comparison table{font-size:13px;min-width:580px} .bfa-comparison thead th{padding:12px 12px} .bfa-comparison td{padding:13px 12px} .bfa-key-takeaways{padding:20px 18px} .article-content .bfa-key-takeaways li{grid-template-columns:1fr;row-gap:4px} .bfa-checklist{padding:20px 18px} .bfa-callout{padding:20px 18px} .bfa-callout li{padding-left:40px} .bfa-illustration img{max-height:300px} .bfa-faq{padding:22px 18px;border-radius:16px} .bfa-faq h3,.bfa-faq h3.wp-block-heading{margin:20px 0 0 40px;padding-top:20px;font-size:17.5px} .bfa-faq h3::before{left:-40px;top:20px;width:28px;height:24px;line-height:24px;font-size:11.5px} .bfa-faq p{margin-left:40px;font-size:16px} .bfa-pullquote{font-size:18px} }![Line drawing of a man at his desk beside a laptop showing an envelope with a check mark](https://bestforandroid.com/wp-content/uploads/2026/05/mass-mailing-for-businesses-bnw-hero.jpg) Sender Policy Framework, or SPF, is the email authentication standard that tells receiving mail servers which IP addresses and services may send mail for your domain. It’s published in DNS as a TXT record that starts with `v=spf1`, followed by mechanisms such as `a`, `mx`, `include`, `ip4` and `ip6`, plus an optional `redirect`. A business might let Google Workspace, a marketing platform, a CRM and a help desk all send from the same domain. Each of those services asks you to add its own include, and some of them hide more includes behind it. SPF still matters because it helps stop spoofing, keeps legitimate mail out of spam folders and works with DKIM to satisfy DMARC. A basic record works fine for a small company with one mailbox provider. Add a sales platform, a support system, a newsletter tool and payroll software, though, and the record starts to strain. That’s the problem SPF flattening is meant to solve, and it’s also where flattening can quietly go wrong. How SPF Affects Authentication and Delivery ------------------------------------------- ![Line drawing of a man at a desk with a laptop showing a shield and a monitor showing a password field](https://bestforandroid.com/wp-content/uploads/2026/05/enterprise-ready-password-manager-bnw-hero.jpg) When a message arrives, the receiving server checks whether the IP address that delivered it is listed in the SPF record of the sending domain (the envelope sender, also called the Return-Path). A match is a pass. No match is a fail or a softfail, depending on whether the record ends in `-all` or `~all`. A record the server can’t evaluate at all returns a permerror. A failed check doesn’t always mean rejection, but it pushes mail toward the spam folder, and repeated failures drag down the domain’s reputation. If you send newsletters or campaigns, our guide to [mass email marketing without the spam folder](https://bestforandroid.com/mass-mailing-for-businesses/) covers the content side of the same problem. ### Why SPF alignment matters for DMARC DMARC passes when SPF or DKIM passes and matches the domain in the visible From address. If your SPF record is broken, too long or over its [DNS lookup](https://threat.media/definition/what-is-a-dns-lookup/) limit, SPF stops counting for every sender at once, and DMARC has to lean on DKIM alone. Spoofed invoices and phishing emails that borrow your name are exactly what this layer is meant to stop, and our [playbook for protecting a business from cyberattacks](https://bestforandroid.com/strategies-to-protect-business-from-cyberattacks/) covers the defenses around it. What SPF Flattening Is and How an SPF Flattening Service Works -------------------------------------------------------------- Before flatteningAfter flatteningRecord`v=spf1 include:_spf.google.com include:mailgun.org include:sendgrid.net ~all``v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip4:167.89.0.0/17 … ~all`DNS lookups80When a vendor adds new IPsPicked up on the next checkMissed until the record is flattened againReadabilityShows which services send for youA long list of address rangesSPF flattening replaces DNS-based mechanisms, mainly include, a and mx and any includes nested inside them, with the IP addresses they point to. Instead of making the receiving server follow a chain of includes during every check, the flattened record lists those addresses directly. The table above uses three common senders. As includes, they cost 8 lookups, because Mailgun’s include alone triggers four more behind it. Written out as ip4 and ip6 ranges, they cost none, since IP mechanisms don’t count toward the limit. ### What an SPF flattening tool actually does An SPF flattening tool typically works through these steps: 1. **Reads** the current SPF record from DNS. 2. **Resolves** every include, a, mx and redirect, including nested ones. 3. **Counts** the DNS lookups the record costs today. 4. **Converts** the mechanisms it safely can into IP addresses. 5. **Publishes** the optimized record, or hands it to you to publish. A good tool also watches the record’s length. One string in a TXT record holds at most 255 characters, so a long flattened record has to be split into several quoted strings, and the SPF standard advises keeping the whole DNS answer under 512 bytes. A record that outgrows that may need to be split across subdomains or trimmed instead. ### Dynamic SPF vs. static flattening Static flatteningDynamic (managed) flatteningHow it worksA one-time list of IP addressesA service re-resolves vendor records and updates the listUpkeepManual, every time a vendor changesAutomatic, with alertsMain riskGoes stale without anyone noticingYou depend on the service and its DNS accessFitsOne or two vendors that rarely changeMany vendors, several domainsStatic flattening cuts lookups, but it hands you a maintenance job, because vendors change their infrastructure without telling you. A dynamic SPF service keeps the flattened record current by checking vendor includes on a schedule and re-flattening when the addresses change. ### Why vendor IP changes matter An outdated record fails the moment a provider starts sending from a new range. Some teams try to handle this with a cron job and manual DNS edits. That can work for one domain, but a purpose-built service is safer once you’re managing several domains and a long list of senders. The SPF 10-DNS-Lookup Limit: Why Flattening Becomes Necessary ------------------------------------------------------------- Include you addServiceLookups it costs`include:_spf.google.com`Google Workspace1`include:spf.protection.outlook.com`Microsoft 3651`include:servers.mcsv.net`Mailchimp1`include:sendgrid.net`SendGrid2`include:_spf.salesforce.com`Salesforce2 (one is an exists macro)`include:mailgun.org`Mailgun5*Counts from each provider’s published SPF record when we checked. Vendors change these without notice, so check your own.* SPF caps a single check at 10 DNS lookups. The terms that count are include, a, mx, ptr and exists, plus the redirect modifier, and nested includes count too, so one include can cost several lookups behind the scenes. The ip4, ip6 and all mechanisms are free. Go past 10 and the receiver returns a permerror. That leads to SPF failures, rejected or junked mail and, under DMARC, no SPF pass at all. There’s a second, lesser-known limit: the standard says a check should fail after more than two lookups that return nothing, which catches records still pointing at a vendor’s retired domain. ### Why include terms and MX lookups add up The problem usually starts innocently. You add Google, then a marketing platform, then a help desk and an invoicing tool. Each include costs at least one lookup, and the big platforms often nest more inside theirs. An mx term costs a lookup for the MX query, and the receiver then has to look up each mail server it returns. That’s how a record that looks short on screen can hit the limit. Four includes can easily cost 10 lookups once the nested ones are counted, and the record gives you no warning until mail starts failing. Benefits, Risks, and Limitations of Using an SPF Flattening Service ------------------------------------------------------------------- ![Line drawing of a man working at a laptop beside a router on a home office desk](https://bestforandroid.com/wp-content/uploads/2026/05/wifi-hacker-apps-bnw-hero.jpg) A flattening service reduces DNS lookups, keeps you under 10 and produces an optimized record, which stops permerrors from hurting delivery. [AutoSPF](https://autospf.com/), for example, focuses on SPF record automation and automatic flattening for teams that don’t want to track vendor IP changes by hand. ### Key benefits The main benefit is control. A flattened record removes the lookup-limit risk, makes checks faster and simpler, and shows your security team exactly which IP addresses are allowed to send. A managed tool can also run a daily check, alert administrators to SPF problems and handle several domains from one place. The second benefit is consistency. When SaaS platforms, security vendors and internal systems all send mail for your domain, automation cuts the manual edits where mistakes creep in, and it keeps a stale record from undermining DMARC. ### Key risks The biggest risk is staleness. If a provider changes its infrastructure and the record isn’t flattened again, its legitimate servers are no longer authorized. That’s why Mailhardener and other email-security practitioners warn against careless static flattening, and why a one-time flatten done by hand is the version that tends to break. Flattening doesn’t fix everything, either. Records that use SPF macros can’t be flattened, because the address being checked isn’t known until a message arrives; Salesforce’s exists macro in the table above is one example, and it needs macro-aware handling. Flattening also hides which services send for you, so keep a readable list of your senders somewhere other than the DNS record. Try These Fixes Before You Flatten ---------------------------------- ![Line drawing of a person checking a phone at a desk next to a Wi-Fi router](https://bestforandroid.com/wp-content/uploads/2026/05/hacking-apps-bnw-h2-0-audit-your-own-network-first.jpg) Flattening isn’t the only way to get under the limit, and the alternatives are often cleaner: - **Remove senders you no longer use.** An old newsletter tool or a trial CRM still costs lookups. - **Move bulk mail to a subdomain.** A subdomain such as news.example.com gets its own SPF record and its own 10-lookup budget. - **Drop terms that don’t send mail.** The ptr mechanism is deprecated, and a or mx is wasted if those servers never send. - **Ask the vendor.** Some providers offer a slimmer include, a dedicated IP or a setup that sends from their own domain instead of yours. If you’re still over 10 after this, flattening is the right tool. You’ll also be flattening a smaller, cleaner record, which is easier to keep accurate. When to Use an SPF Flattening Service and Best Practices for Implementation --------------------------------------------------------------------------- ![Line drawing of a man at his desk holding a phone while his laptop shows an email envelope](https://bestforandroid.com/wp-content/uploads/2026/05/email-apps-bnw-hero.jpg) Use an SPF flattening service when your record is approaching or over 10 lookups, when you rely on many includes, or when nested includes and mx terms make your results unpredictable. It’s also worth it when SPF failures are hurting deliverability, or when your Cloudflare DNS zone holds an SPF record that’s become too complex to maintain by hand. As a rule of thumb, a record at 8 or 9 lookups is one new vendor away from breaking. ### Best practices for safe SPF flattening Start with an SPF check to find your current lookup count. Review every a, mx, include and redirect term, and remove obsolete senders before you flatten. Don’t flatten a record that still includes vendors you’ve stopped using; that only produces a larger and more fragile result. Next, pick a tool that supports automatic flattening, monitoring and alerts. If it can update Cloudflare or your DNS host through an API, upkeep gets much easier. Make sure the tool understands SPF syntax, [TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/) formatting and length limits, and splits long records into strings correctly. Keep a copy of your original, unflattened record so you can roll back quickly. Lower the record’s TTL before the switch, for example to 300 seconds, so a mistake clears from resolver caches fast, and raise it again once everything passes. [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), the SPF standard, is the reference for the lookup and size limits if a vendor’s advice contradicts the tool. Before You Publish a Flattened SPF Record ----------------------------------------- Operational checklist - The record stays under the 10-lookup limit, and under two void lookups. - The flattened record covers every approved sending IP address. - Includes and mx terms have been reviewed, and unused ones removed. - SPF passes when you send test messages to Gmail, Outlook and Yahoo inboxes. - DMARC, DKIM and SPF alignment are monitored together, using DMARC reports. - A daily check or automated monitor is in place, re-checking every 24 hours. - The record can be flattened again quickly when a vendor changes its IP addresses. A managed, dynamic setup is usually better than a one-time manual flatten. When you compare tools, look at how often each one re-checks vendor records, whether it warns you before publishing a change, and how easily you can roll back. SPF Flattening FAQ ------------------ ### Does SPF flattening improve deliverability? Only if your record was failing. Flattening fixes permerrors caused by the 10-lookup limit; it doesn’t make a valid record more trusted. If SPF already passes, put the effort into DKIM, DMARC and sending reputation. ### Is SPF still required if I use DKIM and DMARC? Yes. Google’s [email sender guidelines](https://support.google.com/a/answer/81126) require bulk senders, anyone sending 5,000 or more messages a day to Gmail accounts, to set up SPF, DKIM and DMARC, and other large mailbox providers have followed with similar rules. ### How often should a flattened SPF record be refreshed? Daily is a sensible minimum. Managed services check vendor records on a schedule and update yours when something changes, which is the main reason to use one instead of a script you run by hand. ### Can I flatten an SPF record myself? You can, using dig or an online SPF checker to resolve each include, but you then own the upkeep. A hand-flattened record is the version most likely to go stale.