SPF Flattening: When It Helps and When It Bites

Why flatten SPF?

SPF is limited to 10 DNS lookups when it is evaluated. Each include: (for Google, a CRM, an ESP, etc.) can consume several. Cross the limit and SPF returns permerror and fails, even though your record looks correct.

What flattening does

Flattening resolves the include: mechanisms down to their underlying IP addresses, so your record uses ip4:/ip6: entries instead of chained lookups. That keeps you safely under the limit.

The trade-off

Flattened records must be kept in sync: if a provider changes its sending IPs, your hardcoded list goes stale. Re-check periodically, or only flatten the includes that are stable.

When not to flatten

Flattening a large provider such as Google or Microsoft is the riskiest kind, because their IP ranges change without warning and the resulting record can be enormous. Pruning is usually the better first move: remove the vendors that no longer send for you, and you often drop back under 10 without touching the stable includes.

Keeping a flattened record fresh

A flattened record is a snapshot with an expiry date nobody writes down. Re-resolve the includes you flattened on a schedule and compare the IP list, because the failure mode is silent: mail from a newly added provider IP simply stops passing SPF, with no error anywhere in your own systems.

Check yours now

Resolve your current record with the free SPF flattener to see the real lookup count and what flattening would produce. If pruning turns out to be the better fix, rebuild the record from your actual senders with the free SPF record generator, and SPF record setup covers the rest.