--- title: "Reducing DNS lookups using SPF flattening | AutoSPF" description: "In SPF, a DNS lookup is the process using which the receiving mail server fetches the SPF TXT record of the sender’s domain." image: "https://autospf.com/og/blog/reducing-dns-lookups-using-spf-flattening.png" canonical: "https://autospf.com/blog/reducing-dns-lookups-using-spf-flattening/" --- Quick Answer In SPF, a DNS lookup is the process using which the receiving mail server fetches the SPF TXT record of the sender’s domain. This is done to verify if the sender is authorized to send messages on behalf of the domain owner. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Freducing-dns-lookups-using-spf-flattening%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Reducing%20DNS%20lookups%20using%20SPF%20flattening&url=https%3A%2F%2Fautospf.com%2Fblog%2Freducing-dns-lookups-using-spf-flattening%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Freducing-dns-lookups-using-spf-flattening%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Freducing-dns-lookups-using-spf-flattening%2F&title=Reducing%20DNS%20lookups%20using%20SPF%20flattening "Share on Reddit") [ ](mailto:?subject=Reducing%20DNS%20lookups%20using%20SPF%20flattening&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Freducing-dns-lookups-using-spf-flattening%2F "Share via Email") ![Reducing DNS lookups](https://media.mailhop.org/autospf/images/2025/02/how-to-create-spf-record-6912.jpg) In SPF, a DNS lookup is the process using which the receiving [mail server](https://www.activecampaign.com/glossary/mail-server) fetches the SPF TXT record of the sender’s domain. This is done to verify if the sender is authorized to send messages on behalf of the domain owner. However, to prevent abuse and overburdening, RFC has imposed a limit of a maximum of 10 DNS lookups per SPF record. Now, each mechanism triggers recursive DNS queries. This means that each instance of mechanisms like ‘include,’ ‘a,’ ‘mx,’ etc. counts towards this limit. Also, if a DNS query returns NXDOMAIN or empty, it’s also counted towards the limit. > “The misconception about SPF flattening is that it’s a one-time fix,” says Adam Lundrigan, CTO of DuoCircle and architect of AutoSPF’s flattening engine. “Vendor IP ranges change constantly - Google rotated their \_netblocks three times in 2025 alone. A flattened record that isn’t automatically re-resolved goes stale and silently de-authorizes legitimate senders. That’s why AutoSPF re-scans every 15 minutes.” > “The 10-lookup limit is the single most common reason enterprise SPF records silently break,” says Brad Slavin, General Manager of DuoCircle and founder of AutoSPF. “In our experience managing SPF for 2,000+ customer domains, the failure mode is always the same: a team adds a new SaaS tool, its include pushes the total past 10, and legitimate email starts failing - but nobody notices until a customer complains about missing invoices or password resets.” _Per [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), SPF evaluation is capped at 10 DNS mechanism lookups and 2 void lookups per check - exceeding either limit produces a `PermError` that fails authentication for every message from the domain._ _If your SPF record exceeds the DNS lookup limit, it becomes invalid. In simpler words, it stops performing SPF authentication checks or triggers false positives._ So, it’s obvious that you can’t afford to exceed this limit; otherwise, the whole purpose of deploying SPF will defy. So, what can you do to stay within the limit? Well, you can always use SPF flattening tools to reduce the number of [DNS lookups](https://www.digicert.com/faq/dns/how-does-dns-lookup-work). Let’s see how all of this works. ## SPF and DNS lookup process Upon receiving an email from your domain, the recipient’s server performs DNS lookups to retrieve the corresponding SPF record and verify if the message has been sent from an authorized server. The steps flow like this- ### 1\. Extract the MAIL FROM domain When an email is received, the [MAIL FROM](https://www.ibm.com/docs/en/zvm/7.2?topic=commands-mailfrom) (Envelope From) domain (e.g., example.com) is noted. [SPF checks](/spf-record-checker/) are performed against this domain, not the visible ‘From’ field in the email. ### 2\. Query DNS for SPF record The recipient’s mail server performs a [DNS TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/) lookup for example.com to get to know the SPF policy. ### 3\. Evaluate SPF record The SPF record contains mechanisms like ‘ip4,’ ‘ip6,’ ‘a,’ ‘mx,’ ‘include,’ etc. Each may trigger further DNS lookups: | Mechanism | DNS lookup type | Description | | --------- | ----------------- | ----------------------------------------------------------------------------------------------------------- | | ip4/ip6 | None | Directly compares IP addresses; no DNS lookup needed. | | a | A record lookup | Resolves the domain’s A record to get an [IP address](https://www.investopedia.com/terms/i/ip-address.asp). | | mx | MX record lookup | Retrieves the domain’s MX records, then resolves their A records. | | include | TXT record lookup | Retrieves SPF record from another domain (recursive check). | | exists | A record lookup | Checks if a domain resolves to any IP address. | | redirect | TXT lookup | Redirects to another domain’s SPF record (like include). | ### 4\. Recursive DNS lookups _When the server encounters ‘include,’ ‘mx,’ or ‘a’ mechanisms, it performs additional DNS queries_. These recursive lookups can result in multiple [DNS queries](https://www.cloudns.net/wiki/article/254/). ### 5\. Evaluate results against the sender’s IP The IP address of the sending mail server is compared against the authorized IPs from the SPF record. Based on the match, [SPF](/blog/what-is-spf-email-a-guide-to-sender-validation-technology/) evaluation returns: - PASS: Allowed - FAIL: Rejected (-all) - SOFTFAIL: Not recommended, but still accepted (\~all) - NEUTRAL: No policy (?all) - PERMERROR: Invalid SPF record - TEMPERROR: Temporary DNS issues ### 6\. Decision to accept or reject The result of the SPF check helps the recipient’s mail server decide whether to accept, flag, or reject the email. It is often used with [DMARC](/10-reasons-for-regular-spf-record-checks-in-cybersecurity/dmarc-record-check/) to enforce email policies based on SPF and [DKIM](/10-reasons-for-regular-spf-record-checks-in-cybersecurity/dkim-record-check/). ## How SPF flattening helps reduce the number of DNS lookups ![email infrastructure](https://media.mailhop.org/autospf/images/2025/02/spf-checker-9725.jpg) Staying within the lookup limit is difficult, especially if your [email infrastructure](https://www.voilanorbert.com/blog/email-infrastructure/) has dynamic IPs and multiple servers. If this limit is exceeded, your SPF record will hit the Permerror, causing email delivery issues. Here’s an example of an unflattened [SPF record](/spf-record-checker/create-spf-record/)\- ``` v=spf1 include:_spf.google.com include:vendor.com include:vendor2.net -all ``` _However, SPF flattening resolves all IP addresses upfront and replaces ‘include,’ ‘a,’ ‘mx,’ and other mechanisms with a direct list of IP addresses_. Here’s an example of a resolved SPF record- ``` v=spf1 ip4:203.0.113.5 ip4:192.168.1.1 ip4:185.23.45.67 -all ``` In the above example, IPs have been resolved in advance, so there is no need for DNS lookups during the email validation process. ![email validation process](https://media.mailhop.org/autospf/images/2025/02/spf-validator-7894.jpg) Let’s break down how exactly SPF flattening reduces DNS lookups- | SPF mechanism | DNS lookup type | Flattening behavior | | ------------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | include: | TXT lookup (and possibly others) | Resolves all IPs from the included domain upfront and replaces them with IP addresses. | | a | A/AAAA lookup | Resolves the A/AAAA record and replaces it with IP addresses. | | mx | MX lookup → A lookup | Resolves [MX records](https://support.dnsimple.com/articles/mx-record/), then resolves each to A/AAAA records and replaces them with IPs. | | ptr | PTR lookup (deprecated) | It’s avoided altogether because it’s slow and unreliable. | | exists: | A lookup | Evaluates the condition and is often avoided during flattening. | | ip4/ip6 | None (static IPs) | It’s already IP-based, so no flattening is needed. | This also reduces the DNS query load, leading to faster email evaluation, fewer chances of DNS failures, and fewer queries to [DNS servers](https://www.ibm.com/think/topics/dns-server). Moreover, receiving mail servers find it easier to evaluate a flattened SPF record as it includes a static list of IPs and not dynamic. ## Evading the risks with AutoSPF’s flattening tool If a service provider (e.g., Google, Mailchimp) changes their sending IPs, your flattened SPF record can become outdated, causing mail delivery issues. But with [our automatic SPF flattening tool](/), you can manage this risk and stay within the lookup limit. Our tool works by combining IP ranges to reduce the number of entries. Want to know more about how we can help? [Contact us](/contact-us/). ## Topics [ DKIM ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ SPF ](/tags/spf/)[ SPF Flattening ](/tags/spf-flattening/)[ SPF Flattening tool ](/tags/spf-flattening-tool/)[ SPF record ](/tags/spf-record/) ![Adam Lundrigan](https://media.mailhop.org/autospf/images/authors/adam-lundrigan.jpg) [ Adam Lundrigan ](/authors/adam-lundrigan/) CTO CTO of DuoCircle. Architect of AutoSPF's SPF flattening engine and DNS monitoring infrastructure. [LinkedIn Profile →](https://www.linkedin.com/in/adamlundrigan/) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 6m 6 Best practices for maintaining an SPF record Jun 5, 2025 ](/blog/6-best-practices-for-maintaining-an-spf-record/)[ Intermediate 6m Your SPF record is broken- What does it mean and how do you fix it? Jan 16, 2025 ](/blog/broken-spf-record-meaning-and-how-to-fix-it/)[ Intermediate 6m Broken SPF record- What does it mean and how to fix it! Mar 13, 2025 ](/blog/broken-spf-record-what-does-it-mean-and-how-to-fix-it/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Reducing DNS lookups using SPF flattening","description":"In SPF, a DNS lookup is the process using which the receiving mail server fetches the SPF TXT record of the sender’s domain.","url":"https://autospf.com/blog/reducing-dns-lookups-using-spf-flattening/","datePublished":"2025-02-19T21:06:01.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2025-02-19T21:06:01.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/adam-lundrigan/#person","name":"Adam Lundrigan","url":"https://autospf.com/authors/adam-lundrigan/","jobTitle":"CTO","description":"Adam Lundrigan is the Chief Technology Officer of DuoCircle, where he leads engineering and is responsible for the architecture of AutoSPF's SPF flattening engine and DNS monitoring infrastructure. His technical focus is the DNS-level behavior of SPF evaluation, the recursive include resolution logic that underpins flattening, and the monitoring systems that keep customer SPF records healthy as their upstream vendors change IP ranges.","image":"https://media.mailhop.org/autospf/images/authors/adam-lundrigan.jpg","knowsAbout":["SPF Flattening","DNS Architecture","Recursive Include Resolution","SaaS Engineering","DNS Monitoring","Infrastructure Automation"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/adamlundrigan/"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/reducing-dns-lookups-using-spf-flattening/"},"articleSection":"intermediate","keywords":"DKIM, DMARC, SPF, SPF Flattening, SPF Flattening tool, SPF record","wordCount":883,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2025/02/how-to-create-spf-record-6912.jpg","caption":"Reducing DNS lookups","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Reducing DNS lookups using SPF flattening","item":"https://autospf.com/blog/reducing-dns-lookups-using-spf-flattening/"}]} ```