How does SPF flattening affect email evaluation tools and are there alternatives?
Matthew Whittaker
Co-founder & CTO, Suped
Published 8 Aug 2025
Updated 17 Aug 2025
8 min read
Dealing with Sender Policy Framework (SPF) records can be tricky, especially when your email setup involves multiple sending services. I've often seen situations where SPF records grow so complex they exceed the 10 DNS lookup limit, leading to authentication failures and potential deliverability issues. This limit, specified in RFC 7208, is a common hurdle for many organizations.
To get around this, SPF flattening emerged as a popular technique. The idea is to replace include mechanisms and other DNS lookups with direct IP addresses, effectively shrinking the record. While this sounds like a straightforward solution, it introduces its own set of complications, especially when it comes to how email evaluation tools interpret these records.
This article will explore how SPF flattening impacts email evaluation tools, why these discrepancies occur, and what alternatives or best practices you can adopt to ensure your SPF records are both compliant and accurately assessed.
SPF flattening is a process designed to help domains adhere to the 10 DNS lookup limit for SPF records. Each a, mx, ptr, and include mechanisms in an SPF record count as a DNS lookup. Exceeding this limit can cause legitimate emails to fail SPF authentication, leading to them being marked as spam or rejected outright.
The core of SPF flattening involves converting these DNS-dependent mechanisms into explicit IP addresses (or IP ranges) within the SPF record. For example, an include:thirdparty.com directive, which normally triggers an additional DNS lookup to resolve the SPF record of thirdparty.com, would be replaced with ip4:192.0.2.1 or ip6:2001:db8::1 for all IPs listed in thirdparty.com's SPF record. This static approach avoids exceeding the lookup limit during email authentication checks.
The critical issue with SPF flattening often emerges when you use email evaluation tools like MXToolbox or Litmus. While your IT team might confirm the SPF record is correct from a raw DNS perspective, these tools might flag errors or inconsistencies. This often stems from how they parse and interpret flattened SPF records, especially those with dynamic components or SPF macros.
Many of these tools are designed to follow the original SPF specification strictly, including the DNS lookup process. When confronted with a flattened record that lists only IP addresses, they may not recognize it as a typical, dynamically managed SPF record. This can lead to false positives, where the tool reports an error, even if the record is functionally valid for email authentication. This is also why MXToolbox sometimes reports SPF as too 'thick' while other tools might show a higher score.
Another complication arises from the dynamic nature of sending IP addresses. Services like Google Workspace or Outlook regularly update their sending IP ranges. A manually flattened SPF record, hardcoding these IPs, can quickly become outdated, leading to authentication failures for legitimate emails sent from newly added IPs. Tools evaluating these static records will simply see an IP that isn't listed, triggering an error.
This mismatch between how SPF flattening works and how some older evaluation tools process records can cause significant headaches. It creates a situation where your internal configurations are correct for real-world email delivery, but diagnostic tools suggest otherwise.
Inaccurate tool reports
Many legacy SPF evaluation tools may not correctly parse or validate flattened SPF records, leading to false negatives (reporting issues where none exist). This is especially true if they don't support SPF compression techniques.
Maintenance burden
Manually flattening your SPF record means you need to constantly monitor and update IP addresses from all your sending services. If an IP changes and you don't update your record, your legitimate emails will fail SPF checks, leading to deliverability problems.
Potential for errors
Manually maintaining a list of IP addresses is prone to human error, potentially leading to incorrect SPF records that can either reduce deliverability or, worse, open your domain to spoofing if unauthorized IPs are inadvertently included.
Alternatives to SPF flattening
Given the challenges associated with manual SPF flattening and its impact on email evaluation tools, it's worth considering alternatives that offer both compliance and ease of management. The primary alternative is to use a dynamic SPF service, which automatically manages your SPF record and keeps it updated with the correct IP addresses, bypassing the 10 DNS lookup limit without requiring manual intervention.
These services act as a proxy for your SPF record, dynamically resolving the IP addresses of your authorized sending sources in real time. This means that instead of a long, static list of IPs in your DNS, your SPF record points to the dynamic SPF service, which then handles all the necessary lookups behind the scenes. This method ensures that your SPF record is always up-to-date, even when your third-party email providers change their IP ranges, helping to prevent hidden SPF DNS timeouts.
The major advantage of dynamic SPF services is that they automate the complex task of SPF management. This significantly reduces the risk of human error and ensures that your emails consistently pass SPF authentication, improving your email deliverability and protecting your domain from spoofing. This approach also integrates smoothly with DMARC and DKIM, providing a comprehensive email authentication strategy.
Manual SPF flattening
Process: Replace all include mechanisms and other DNS lookups with direct IP addresses in your SPF record. Requires manual lookup and frequent updates.
Maintenance: High, as IPs from third-party services can change frequently, necessitating constant monitoring and manual updates to prevent deliverability issues. This leads to common SPF TempErrors.
Accuracy: Prone to human error and can quickly become outdated. Traditional evaluation tools might misinterpret these static records.
Dynamic SPF service
Process: Your SPF record points to a service that dynamically resolves and updates the authorized IP addresses. It bypasses the 10-lookup limit automatically.
Maintenance: Low. The service handles all updates and changes to IP ranges, ensuring your SPF record is always current without manual intervention.
Accuracy: Highly accurate and always up-to-date. Reduces false negatives from evaluation tools that can handle dynamic SPF resolution.
Validating your SPF record
When SPF flattening is implemented, it's crucial to use email evaluation tools that can accurately interpret your record. Standard SPF checkers might provide misleading results if they don't account for dynamically managed or flattened SPF. You need tools that understand the nuances of how these records are constructed and interpreted by receiving mail servers.
Beyond simply checking the syntax, it's important to verify SPF alignment. This refers to whether the domain in the Return-Path (or Mail From) header matches the From header domain. Correct alignment is crucial for DMARC to pass. If your SPF alignment is inconsistent or not aligned, it will negatively affect email deliverability, even if SPF authentication itself passes.
Instead of relying solely on generic checkers, consider using dedicated email deliverability testing tools that provide comprehensive reports, including SPF, DKIM, and DMARC validation. These tools often simulate how various ISPs and mail servers will evaluate your emails, giving you a more accurate picture of your email's deliverability. Some tools also offer specific functionalities to test against the 10 DNS lookup limit, ensuring compliance for Google Postmaster Tools and others.
Ultimately, the goal is to choose a method that balances compliance with ease of management, ensuring that your legitimate emails reach the inbox consistently. Whether you opt for a dynamic SPF service or carefully manage a flattened record, thorough testing with appropriate tools is key.
Checker type
Pros
Cons
Best for
Basic online SPF checkers
Quick syntax validation, free access
Often struggle with SPF flattening and macros, may give false negatives. Refer to Kitterman's tool.
SPF flattening is a technique to address the 10 DNS lookup limit, but it's not without its drawbacks, particularly concerning how email evaluation tools interpret these records. Relying on manually flattened records can lead to constant maintenance and potential errors, undermining your email deliverability efforts.
For most organizations, dynamic SPF services offer a more robust and automated solution. These services ensure your SPF record remains accurate and compliant, adapting to changes from your sending providers without manual intervention. By choosing the right approach and using appropriate validation tools, you can ensure your email authentication is solid, leading to better inbox placement and overall email success.
Views from the trenches
Best practices
Always validate your SPF record using tools that support dynamic lookups.
Consider implementing a dynamic SPF service to automate record management.
Regularly review your DMARC reports to identify SPF authentication failures.
Ensure SPF records are as concise as possible to minimize complexity.
Align your SPF and DKIM domains with your DMARC policy for optimal protection.
Common pitfalls
Manually updating flattened SPF records, leading to outdated IPs.
Exceeding the 10 DNS lookup limit, causing SPF authentication failures.
Relying on basic SPF checkers that don't interpret flattened records correctly.
Ignoring SPF alignment issues which can still impact DMARC pass rates.
Not monitoring DMARC reports for insights into SPF authentication results.
Expert tips
When dealing with SPF macros or flattening, standard checkers often fail. Use a checker that specifically supports these advanced configurations for accurate results.
If you find yourself needing to flatten SPF, it's a good indicator that your record might be trying to include too many unnecessary elements. Re-evaluate your sending services and consolidate where possible.
Always test your SPF records in a real-world environment, such as by sending an email to a test account or using comprehensive deliverability testing tools, in addition to static checkers.
Pay close attention to temporary SPF failures in your DMARC reports. These can often point to dynamic IP changes from your sending providers if you are using manual flattening.
Focus on achieving SPF alignment, not just SPF pass. A DMARC policy requires alignment to truly protect your domain and improve deliverability.
Expert view
Expert from Email Geeks says SPF macros are not handled well by many email evaluation tools, which can lead to misinterpretations of your record.
2024-10-09 - Email Geeks
Expert view
Expert from Email Geeks says some checkers have difficulty with SPF macros, flatteners, and automated processes within SPF records.
MXToolbox or 
Litmus. While your IT team might confirm the SPF record is correct from a raw DNS perspective, these tools might flag errors or inconsistencies. This often stems from how they parse and interpret flattened SPF records, especially those with dynamic components or SPF macros.
Outlook regularly update their sending IP ranges. A manually flattened SPF record, hardcoding these IPs, can quickly become outdated, leading to authentication failures for legitimate emails sent from newly added IPs. Tools evaluating these static records will simply see an IP that isn't listed, triggering an error.
AutoSPF, 
DMARC Advisor, etc.)
