--- title: "SPF Flattening Explained: Fix the 10-Lookup Limit | AutoSPF" description: "SPF flattening resolves your include, a, and mx mechanisms into IP addresses so your record stays under the 10-lookup limit and email keeps passing SPF." image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/spf-flattening/" --- # SPF flattening SPF flattening resolves the include, a, and mx mechanisms in your SPF record into their underlying IP addresses, keeping DNS lookups under the RFC 7208 limit of 10 so your record stays valid and legitimate email keeps passing authentication. SPF flattening is the practice of resolving every lookup-driven mechanism in your SPF record - `include:`, `a`, `mx`, `ptr`, `exists`, and `redirect=` \- down to the concrete IP addresses behind them, then publishing those addresses directly as `ip4:` and `ip6:` entries. The point is simple: keep your record inside the strict limits that email receivers enforce, so legitimate mail keeps authenticating as your sending infrastructure grows. This page is the hub for everything SPF flattening. It explains what flattening is, why the 10-lookup limit forces the issue, how the process works step by step, and where the real trade-offs and risks live. From here you can go deeper on the specific tasks: [how to flatten an SPF record](/spf-flattening/how-to-flatten-an-spf-record/), the [best SPF flattening tools](/spf-flattening/best-spf-flattening-tools/), whether [SPF flattening affects DKIM & DMARC](/spf-flattening/does-spf-flattening-affect-dkim-dmarc/), doing it on [Cloudflare](/spf-flattening/cloudflare-spf-flattening/), and how flattening compares to [SPF flattening vs macros](/spf-macros-vs-flattening/). ## What is SPF flattening? An SPF record is a single `TXT` record, beginning with `v=spf1`, that tells receiving mail servers which hosts are allowed to send email for your domain. When you add a service - a CRM, a marketing platform, a helpdesk, a transactional email provider - you typically add an `include:` for it. Each `include:` points at another domain’s SPF record, and the receiver has to fetch that record at evaluation time. Those fetches are DNS lookups, and they add up fast. SPF flattening takes all of those indirect references and pre-resolves them. Instead of asking the receiver to chase `include:_spf.google.com` down through nested `_netblocks` records, a flattened record simply lists the underlying IP ranges: - **Before:** `v=spf1 include:sendgrid.net include:_spf.google.com a mx -all` - **After:** `v=spf1 ip4:149.72.0.0/16 ip4:167.89.0.0/17 ip4:64.233.160.0/19 ip6:2a00:1450:4000::/36 -all` At evaluation time the receiver no longer recurses through includes or resolves `A`/`MX` targets - it just compares the connecting IP to your published `CIDR` ranges. That drops the runtime DNS lookup count to effectively zero and keeps your record light, fast, and reliable. > “The 10-lookup limit is the single most common reason enterprise SPF records silently break,” says Brad Slavin, General Manager of DuoCircle and founder of AutoSPF. “In our experience managing SPF for 2,000+ customer domains, the failure mode is always the same: a team adds a new SaaS tool, its include pushes the total past 10, and legitimate email starts failing - but nobody notices until a customer complains about missing invoices or password resets.” ## Why the 10-DNS-lookup limit forces flattening Per [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), SPF evaluation is capped at **10 DNS mechanism lookups** and **2 void lookups** per check. Exceeding either limit produces a `PermError` \- a permanent failure that tells receiving servers your email cannot be authenticated. The server does not retry, and it does not evaluate the rest of your record. It simply stops, and every message from your domain fails SPF. The trap is that this limit is invisible until you cross it. A small business sending through one provider will never hit it. But modern email stacks routinely stack up multiple ESPs, a CRM, a support desk, and internal mail - and each adds one or more lookups. Google Workspace alone consumes about four of your ten lookups through its nested includes. Add Salesforce, Mailchimp, SendGrid, and Zendesk and you can easily reach twelve to fifteen. The eleventh lookup is never evaluated, so whatever service happens to sit past that point silently loses authorization. Here is which mechanisms count: | Triggers a DNS lookup | Does **not** trigger a lookup | | ----------------------------- | ----------------------------- | | include:example.com | ip4:x.x.x.x\[/CIDR\] | | a, a:example.com | ip6:… | | mx, mx:example.com | all | | ptr (discouraged by RFC 7208) | | | exists:domain | | | redirect=example.com | | Because `ip4:` and `ip6:` mechanisms require no resolution, flattening trades every lookup-driven mechanism for lookup-free ones. That is the entire mechanism by which flattening keeps you compliant. A quick way to see where you stand today is to run your domain through the [SPF Checker](/tools/spf-checker/), which expands every include and counts your lookups. ## Why flattening matters for deliverability and security The 10-lookup limit is not just a technical footnote - it sits directly on the path between your mail and the inbox. **Deliverability.** DMARC relies on SPF and DKIM. If your SPF record returns a `PermError`, DMARC treats that as a failure, and legitimate mail can be quarantined or rejected. Since 2024, Google, Yahoo, and Microsoft have required bulk senders to authenticate with SPF, DKIM, and DMARC, and they now reject non-compliant messages outright rather than routing them to spam. Together those providers cover roughly 90% of a typical consumer list, so a single over-limit record can cut off delivery to most of your audience at once. **Security.** When SPF fails, receiving servers lose the ability to tell your legitimate mail apart from spoofed messages. That is precisely the gap that phishing and business email compromise exploit. Keeping SPF valid - and inside the limit - preserves the authentication signal that separates you from an attacker impersonating your domain. **Manageability.** As your brand grows, so does the list of platforms sending on your behalf. Flattening collapses a sprawling chain of includes into one clean list of IP ranges that is easy to read, audit, and reason about. ## How SPF flattening works, step by step Whether done manually or by automation, flattening follows the same pipeline: 1. **Discovery.** Read your current SPF `TXT` record and identify every mechanism that triggers a lookup - `include`, `a`, `mx`, `exists`, `redirect`. 2. **Recursive resolution.** Follow each `include` chain, fetching the target’s SPF record and recursing until all upstream content is known. Resolve `a`/`mx` targets to their `A`/`AAAA` records to gather both IPv4 and IPv6 addresses. 3. **Deduplicate and compress.** Merge overlapping ranges and aggregate contiguous blocks into `CIDR` notation so the record stays compact. 4. **Publish.** Rewrite the record as `v=spf1 ip4:… ip6:… -all`, respecting the 255-character-per-string `TXT` limit (split into multiple concatenated strings if needed), and update your DNS. 5. **Validate.** Confirm syntax, verify the lookup count is 0-1, and send test mail to confirm `SPF=pass` and `DMARC=pass`. For the full walkthrough with commands and DNS-provider specifics, see [how to flatten an SPF record](/spf-flattening/how-to-flatten-an-spf-record/). ## The catch: a flattened record is not a one-time fix Flattening solves the lookup problem, but it introduces a new one. When you replace a dynamic `include:` with static IPs, you take ownership of keeping those IPs current. Providers rotate their sending infrastructure constantly, and they rarely notify you when they do. > “The misconception about SPF flattening is that it’s a one-time fix,” says Adam Lundrigan, CTO of DuoCircle and architect of AutoSPF’s flattening engine. “Vendor IP ranges change constantly - Google rotated their \_netblocks three times in 2025 alone. A flattened record that isn’t automatically re-resolved goes stale and silently de-authorizes legitimate senders. That’s why AutoSPF re-scans every 15 minutes.” This is the single most important thing to understand about flattening. A hand-built flattened record is accurate the day you publish it and slowly drifts out of date afterward. When a provider adds a new IP range, mail from that range starts failing SPF - and because the failure is silent, you usually learn about it from a bounced invoice or a missed password reset, not an alert. In AutoSPF telemetry across 1,200 domains, flattening reduced `PermError` rates by 93% and improved DMARC pass rates by 7-12% in the first 30 days - but only when the record was kept fresh. Median ESP IP churn runs 2-4 changes per week for high-volume providers. The other trade-offs worth planning for: - **Record size.** Flattening can push a `TXT` record toward DNS size limits. Aim to keep responses under about 1,000-1,200 bytes to avoid UDP fragmentation and truncation, and prefer aggregated `CIDR` ranges over enumerating individual addresses. - **Over-authorization.** Some includes authorize far more of the internet than you actually use. Auditing and trimming before you flatten keeps your attack surface small. ## Manual, scripted, or automated? There are three ways to flatten, with very different risk profiles: - **Manual.** Query each include for its current IPs, aggregate them, and publish by hand. Free and fully under your control, but labor-intensive and prone to drift the moment a provider changes IPs. Practical only for small, static environments. - **Scripted.** A Python or Go script recurses includes, resolves `A`/`MX`, merges `CIDR` ranges, and pushes to DNS via API on a schedule. Repeatable and auditable, but you own the edge cases, the loop-guarding, and the ongoing reliability. - **Automated (dynamic) service.** A hosted service continuously re-resolves your includes, detects IP changes, and republishes automatically. This removes the maintenance burden entirely, at the cost of a managed dependency. For any organization using dynamic providers like Google Workspace, Microsoft 365, SendGrid, or Amazon SES, an automated approach is strongly preferred - the whole difficulty of flattening is keeping up with churn, and that is exactly what automation handles. A full comparison of the options lives in [best SPF flattening tools](/spf-flattening/best-spf-flattening-tools/). ## Where AutoSPF fits [AutoSPF’s automatic SPF flattening service](/) is purpose-built for the maintenance problem that makes flattening risky. It discovers and expands your nested includes, resolves the full `A`/`MX`/`AAAA` chains, deduplicates and compresses ranges into minimal `CIDR` blocks, and publishes a validated, size-aware flattened record that stays under the 10-lookup limit. Two things set it apart: - **It rescans every 15 minutes** and auto-updates your record the moment an upstream provider’s IPs change - so a flattened record never silently goes stale. - **It resolves to the exact same IPs your includes resolve to** \- no broad, over-permissive ranges and no over-authorization. Your flattened record authorizes precisely the hosts your real includes authorize, and nothing more. On top of that it offers versioned records with one-click rollback, canary/staging publishing, and drift alerts when mail arrives from IPs outside your current flattened set. It integrates directly with major DNS providers including Route 53, Cloudflare, Google Cloud DNS, and Azure DNS. Before and after any change, you can confirm the record resolves cleanly with the [SPF Checker](/tools/spf-checker/). ## Flattening across DNS providers and at scale The mechanics of flattening are the same everywhere, but publishing differs by platform. On Cloudflare, for example, you manage the `TXT` record through the dashboard or API and need to respect its string-chunking behavior - the details are covered in [Cloudflare SPF flattening](/spf-flattening/cloudflare-spf-flattening/). At SaaS scale - thousands of tenants, multiple sending streams - the winning pattern is layered: segment mail streams onto subdomains (for example `mkt.example.com` for marketing, `tx.example.com` for transactional), centralize policy with `redirect=` to a small canonical record, fully flatten high-churn providers into aggregated `ip4`/`ip6` sets, and automate refresh with diff-based publishing so unchanged records never cause DNS churn. Delegating heavy senders to subdomains also keeps your organizational domain lean and simplifies DMARC alignment. ## Does flattening change DKIM or DMARC? Flattening only changes _how_ authorized senders are expressed in SPF - `ip4`/`ip6` instead of `include` \- not your domain identity or your DKIM signatures. As long as the flattened SPF is published on the domain used in your `MAIL FROM`/`Return-Path`, DMARC alignment is unaffected, and by eliminating `PermError` it usually _improves_ DMARC pass rates when SPF is the aligned identifier. The full relationship, including how DKIM often carries alignment for bulk senders, is covered in [does SPF flattening affect DKIM & DMARC](/spf-flattening/does-spf-flattening-affect-dkim-dmarc/). ## Flattening vs SPF macros Traditional flattening pre-resolves includes into static IPs, which is why it needs constant refreshing. SPF macros take a different route: they use dynamic expansion so a single record can authorize an effectively unlimited number of senders without ever hitting the 10-lookup limit - at the cost of added complexity and weaker resolver support. Which approach suits you depends on your infrastructure and appetite for maintenance; the full breakdown is in [SPF flattening vs macros](/spf-macros-vs-flattening/). ## Frequently Asked Questions ### What is SPF flattening in simple terms? SPF flattening is the process of replacing the `include:`, `a`, and `mx` mechanisms in your SPF record with the actual IP addresses they resolve to. This gives receiving mail servers a ready-made list of authorized IPs instead of forcing them to perform DNS lookups, which keeps your record within the 10-lookup limit defined by RFC 7208 and prevents authentication failures. ### Why is SPF flattening necessary? Flattening becomes necessary when your domain exceeds the SPF specification’s cap of 10 DNS lookups per evaluation. Once you cross that limit, SPF returns a `PermError` and every message from your domain fails authentication, which can also cause DMARC to fail. Because most organizations use several third-party senders that each add includes, growing domains hit the ceiling quickly and need flattening to stay compliant. ### Does SPF flattening improve email deliverability? Yes. By eliminating the `PermError` and `TempError` conditions caused by too many lookups or slow upstream includes, flattening keeps SPF passing reliably. In AutoSPF customer data, moving from 12-18 lookups to a fully flattened record reduced SPF-related DMARC failures by more than 80% and improved inbox placement for marketing mail by 10-15% during peak sends. ### How often should a flattened SPF record be updated? As often as your providers change IPs. High-churn ESPs like SendGrid and Mailchimp warrant refreshes every 12-24 hours, stable suites like Google Workspace and Microsoft 365 daily, and static self-hosted ranges weekly. A hand-maintained record almost always drifts - AutoSPF sidesteps this by rescanning every 15 minutes and republishing automatically whenever an upstream range changes. ### Is manual SPF flattening safe? Manual flattening is safe only for small, static environments where sending IPs rarely change. For any domain using dynamic providers, a hand-built record goes stale as soon as a provider rotates its infrastructure, silently de-authorizing legitimate senders. Automated flattening is strongly preferred at any real scale because keeping up with provider churn is the hard part. ### Should I use `-all` or `~all` after flattening? Use `-all` (hard fail) when you are confident your flattened list is complete and actively monitored, since it gives receivers the clearest signal to reject spoofed mail. Use `~all` (soft fail) during rollout or while you are still adding senders frequently. A good practice is to keep `~all` until DMARC reports show a clean pass window, then tighten to `-all`. Rated 5/5 on G2 · Trusted since 2018 ## Trusted by 50,000+ domains ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) ### "Great service and great support" > AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. GF Greg F. Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is SPF flattening in simple terms?","acceptedAnswer":{"@type":"Answer","text":"SPF flattening is the process of replacing the `include:`, `a`, and `mx` mechanisms in your SPF record with the actual IP addresses they resolve to. This gives receiving mail servers a ready-made list of authorized IPs instead of forcing them to perform DNS lookups, which keeps your record within the 10-lookup limit defined by RFC 7208 and prevents authentication failures."}},{"@type":"Question","name":"Why is SPF flattening necessary?","acceptedAnswer":{"@type":"Answer","text":"Flattening becomes necessary when your domain exceeds the SPF specification's cap of 10 DNS lookups per evaluation. Once you cross that limit, SPF returns a `PermError` and every message from your domain fails authentication, which can also cause DMARC to fail. Because most organizations use several third-party senders that each add includes, growing domains hit the ceiling quickly and need flattening to stay compliant."}},{"@type":"Question","name":"Does SPF flattening improve email deliverability?","acceptedAnswer":{"@type":"Answer","text":"Yes. By eliminating the `PermError` and `TempError` conditions caused by too many lookups or slow upstream includes, flattening keeps SPF passing reliably. In AutoSPF customer data, moving from 12-18 lookups to a fully flattened record reduced SPF-related DMARC failures by more than 80% and improved inbox placement for marketing mail by 10-15% during peak sends."}},{"@type":"Question","name":"How often should a flattened SPF record be updated?","acceptedAnswer":{"@type":"Answer","text":"As often as your providers change IPs. High-churn ESPs like SendGrid and Mailchimp warrant refreshes every 12-24 hours, stable suites like Google Workspace and Microsoft 365 daily, and static self-hosted ranges weekly. A hand-maintained record almost always drifts - AutoSPF sidesteps this by rescanning every 15 minutes and republishing automatically whenever an upstream range changes."}},{"@type":"Question","name":"Is manual SPF flattening safe?","acceptedAnswer":{"@type":"Answer","text":"Manual flattening is safe only for small, static environments where sending IPs rarely change. For any domain using dynamic providers, a hand-built record goes stale as soon as a provider rotates its infrastructure, silently de-authorizing legitimate senders. Automated flattening is strongly preferred at any real scale because keeping up with provider churn is the hard part."}},{"@type":"Question","name":"Should I use `-all` or `~all` after flattening?","acceptedAnswer":{"@type":"Answer","text":"Use `-all` (hard fail) when you are confident your flattened list is complete and actively monitored, since it gives receivers the clearest signal to reject spoofed mail. Use `~all` (soft fail) during rollout or while you are still adding senders frequently. A good practice is to keep `~all` until DMARC reports show a clean pass window, then tighten to `-all`."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"SPF Flattening","item":"https://autospf.com/spf-flattening/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```