Glossary

SPF Flattening

Reduces SPF DNS lookup count by resolving includes into IP addresses

SPF flattening is a technique that replaces DNS-querying SPF mechanisms such as "include:" and "a" with their resolved IP addresses, reducing the number of DNS lookups required to evaluate an SPF record and keeping it under the RFC 7208 limit of ten lookups.

What is SPF Flattening?

SPF flattening is a practice used to solve the SPF 10-lookup problem. The SPF specification (RFC 7208) limits SPF record evaluation to a maximum of ten DNS lookups. Every "include:", "a", "mx", "ptr", and "exists" mechanism in an SPF record consumes one lookup toward this limit. Many organisations that use multiple email services — such as Google Workspace, Salesforce, Mailchimp, Zendesk, and others — quickly exceed this limit.

When the 10-lookup limit is exceeded, the SPF evaluation returns a "PermError" result rather than a Pass or Fail. Many receiving mail servers treat PermError as a fail, meaning legitimate email can be rejected or marked as spam. SPF flattening resolves this by replacing the include mechanisms with the actual IP addresses they resolve to, eliminating the need for additional DNS lookups during evaluation.

Flattening effectively converts a record with many dynamic includes into a compact list of "ip4:" and "ip6:" ranges that require zero DNS lookups to evaluate.

How Does SPF Flattening Work?

The flattening process begins by recursively resolving all "include:" mechanisms in an SPF record. For each included domain, its SPF record is fetched and any further includes are resolved in turn, until all mechanisms have been traced back to raw IP addresses. The result is a comprehensive list of all IPv4 and IPv6 CIDR ranges that are authorised to send mail for the original domain.

These IP addresses are then written directly into the flattened SPF record as "ip4:" and "ip6:" entries, replacing the original include mechanisms. Because IP address mechanisms do not trigger DNS lookups during evaluation, the flattened record can authorise dozens of sending services while staying within the 10-lookup limit — or even using zero lookups at all.

The key challenge with flattening is maintenance. Email service providers change their IP addresses over time, and a flattened record that is not kept up to date will become inaccurate, potentially causing legitimate mail to fail SPF. Automated flattening tools and services monitor upstream changes and regenerate the flattened record when IP ranges change.

How to Flatten Your SPF Record

You can analyse your current SPF record's lookup count and generate a flattened version using the SPF Flattening Tool at nslookup.net/tools/spf-flattening-tool. Enter your domain and the tool will recursively resolve all includes, count the DNS lookups consumed, list all resolved IP ranges, and produce a flattened SPF record ready to publish in DNS.

Before replacing your existing SPF record, review the generated list of IP ranges to confirm it matches your expected sending infrastructure. After publishing the flattened record, use the SPF Checker to confirm the lookup count is now within limits.

Related Tool

SPF Flattening Tool

Try the Tool →

Frequently Asked Questions

What causes an SPF PermError?

An SPF PermError (permanent error) occurs when the number of DNS lookups required to evaluate an SPF record exceeds 10, when the SPF record contains a syntax error, or when a referenced include domain has no valid SPF record. PermError is treated as a hard failure by many receiving mail servers, which can result in legitimate email being rejected.

Does SPF flattening have any drawbacks?

The primary drawback of SPF flattening is the maintenance burden. Email service providers periodically add, remove, or change the IP addresses in their sending infrastructure. A flattened SPF record must be updated every time an upstream provider changes its IP ranges, otherwise legitimate mail from that provider will fail SPF. Automated flattening services address this by continuously monitoring upstream changes and updating the record automatically.

Is there a limit on the number of IP addresses in an SPF record?

There is no explicit limit on the number of IP address ranges in an SPF record, but the record must fit within the DNS TXT record size limit of 255 characters per string (though multiple strings can be concatenated) and a practical limit of about 512 bytes in a UDP DNS response before truncation occurs. Very large flattened records may need to be served over TCP or may need further consolidation of IP ranges.

What is the difference between SPF flattening and SPF macros?

SPF flattening resolves include mechanisms into static IP addresses. SPF macros are a different approach that uses variables in the SPF record to construct dynamic DNS lookups based on the sending IP address or domain, effectively moving the lookup logic to a single authoritative source. Both techniques aim to stay within the 10-lookup limit, but macros require more complex infrastructure to implement.