When is SPF flattening needed and how to validate SPF records?
Michael Ko
Co-founder & CEO, Suped
Published 21 May 2025
Updated 17 Aug 2025
7 min read
Managing email deliverability can sometimes feel like navigating a complex maze, and SPF records are a significant part of that journey. Sender Policy Framework (SPF) helps prevent email spoofing by allowing domain owners to specify which mail servers are authorized to send email on behalf of their domain. A properly configured SPF record is crucial for ensuring your legitimate emails reach their intended inboxes and aren't flagged as spam.
However, as organizations grow and adopt more third-party email services, their SPF records can become lengthy and complex. This often leads to a common issue: exceeding the 10 DNS lookup limit, which results in SPF validation failures. When this happens, your emails might not get delivered, or they could end up in spam folders, directly impacting your communication and marketing efforts.
This is where SPF flattening (also known as blocklist or blacklist flattening) comes into play. It's a technique designed to circumvent the DNS lookup limit by converting include mechanisms into direct IP addresses. While it sounds like a straightforward solution, understanding when and how to implement it, as well as how to validate your SPF records effectively, is key to maintaining healthy email deliverability. Let's dive into the details.
SPF flattening is a process that takes an SPF record with multiple include mechanisms and resolves them into a consolidated list of IP addresses. Instead of telling receiving mail servers, 'check this domain, then that domain, then another domain,' flattening provides a direct list of authorized IP addresses. This avoids the need for recursive DNS queries, thus staying within the critical 10-lookup limit.
To give you an example, if your SPF record includes mechanisms like include:spf.protection.outlook.com and include:_spf.google.com, each of these include statements triggers a DNS lookup. Some include mechanisms can even trigger multiple lookups themselves, quickly pushing you past the limit. SPF flattening addresses this by replacing the domain names with the actual IP ranges they represent.
There are two main approaches to SPF flattening: manual and dynamic (or automatic). Manual flattening involves periodically looking up all the IP addresses associated with your include statements and updating your DNS TXT record with these IPs. This can be very time-consuming and prone to errors because IP addresses can change frequently. Dynamic SPF flattening, on the other hand, uses a service that automatically monitors and updates your SPF record, ensuring it always reflects the correct IP addresses without exceeding the lookup limit. This is often bundled with DMARC monitoring solutions.
Example of a flattened SPF record
A flattened SPF record typically lists the IP addresses directly. This approach bypasses DNS lookups for included domains, making the validation process quicker and compliant with the 10-lookup rule. Remember that SPF records must also not exceed 255 characters in total length. If you're experiencing CharacterStringTooLong errors, flattening might be part of the solution.
The primary reason SPF flattening becomes necessary is due to the 10-DNS lookup limit imposed by the SPF specification (RFC 7208). Each time an SPF record uses an include, a, mx, ptr, or exists mechanism, it triggers a DNS lookup. Exceeding this limit causes a PermError, leading to SPF authentication failures and potential email deliverability issues. This is why many look to SPF flattening to avoid email failures.
You'll often find SPF flattening recommended when your organization uses numerous third-party email service providers (ESPs). For example, if you use Microsoft 365, Google Workspace, a marketing automation platform like HubSpot, and a transactional email service like SendGrid, each will require its own include mechanism. If any of these includes themselves contain multiple DNS lookups, you can quickly hit the limit.
While SPF flattening can be a necessary workaround for the DNS lookup limit, it's not always the first or only solution. Before resorting to flattening, it's worth reviewing your SPF record for any unnecessary entries or consolidating multiple SPF records. Sometimes, different services use distinct return paths, meaning they might not all need to be in your primary domain's SPF record. Utilizing subdomains for different services can also help manage SPF complexity, as each subdomain can have its own SPF record.
Manual SPF flattening
Process: Involves manually resolving all include mechanisms and updating the SPF record with IP addresses.
Maintenance: Requires frequent manual updates as IP ranges of sending services change.
Risk: High risk of PermError if not kept up-to-date, leading to email delivery issues.
Dynamic (automatic) SPF flattening
Process: Utilizes a service to automatically resolve and update IP addresses in your SPF record.
Maintenance: Automated, minimal manual intervention required, as IP address changes are handled dynamically.
Benefits: Ensures SPF compliance, reduces human error, and improves email deliverability. This is often part of a comprehensive email authentication strategy.
How to validate SPF records
Validating your SPF records, especially after implementing SPF flattening, is a critical step to ensure email deliverability. Incorrectly configured SPF records can lead to emails being rejected, sent to spam, or otherwise fail to deliver. There are several ways to validate your SPF record, from using online tools to manually checking return paths.
Online SPF checkers are widely available and provide an easy way to verify your record's syntax and lookup count. These tools typically perform a DNS query for your domain's SPF record and analyze its structure, reporting any errors or warnings. They can quickly tell you if you're exceeding the 10-lookup limit or if there are any syntax issues. Services like Kitterman's SPF validator or AutoSPF's lookup checker are common choices.
Beyond automated tools, manually inspecting your DMARC reports is another powerful way to validate SPF authentication, especially after implementing flattening. DMARC reports provide detailed insights into how receiving mail servers are handling your emails, including whether SPF passed or failed, and the reasons for any failures. By analyzing these reports, you can identify if your flattened SPF record is correctly authorizing all your sending sources. This can help pinpoint if you are failing SPF even with an IP in the record.
An email service you use is not included in your SPF record.
Add the correct include or IP range for the sender. Consult SPF flattening resources for guidance.
Maintaining a healthy SPF record
My experience in email deliverability has shown me that effective SPF management is about more than just setting up a record; it's about continuous monitoring and adaptation. While SPF flattening can be a lifesaver for complex setups, it requires careful consideration of its trade-offs. The manual overhead can be substantial, making dynamic SPF services an attractive option for many.
Ultimately, the goal is to ensure your emails are consistently delivered, and a healthy SPF record is a foundational element of that. By understanding when SPF flattening is needed and diligently validating your records, you can significantly improve your email program's performance and maintain a strong sending reputation.
Remember that SPF works alongside other email authentication protocols like DKIM and DMARC to provide comprehensive protection against spoofing and phishing. A holistic approach to email security will always yield the best results for your deliverability.
Views from the trenches
Best practices
Periodically review your DMARC reports to identify email sending services not covered by your SPF.
Utilize subdomains for different email sending purposes to decentralize SPF records and manage lookups.
Common pitfalls
Ignoring the 10-DNS lookup limit, leading to SPF PermErrors and failed email authentication.
Manually flattening SPF records without a consistent update schedule, causing outdated IP addresses.
Expert tips
Ensure SPF records only include services whose return path aligns with your apex domain.
Prioritize auditing existing SPF includes before considering flattening, many might be unnecessary.
Expert view
Expert from Email Geeks says: If different services use different return paths, SPF flattening might not be necessary for your apex domain. Only include SPF records for services that genuinely send from your main domain's return path.
2024-08-15 - Email Geeks
Expert view
Expert from Email Geeks says: If your SPF setup is correctly managed, you might not need flattening. Focusing on proper subdomain management can often resolve lookup limit issues without flattening.
Microsoft 365, 
Google Workspace, a marketing automation platform like 
HubSpot, and a transactional email service like 
SendGrid, each will require its own include mechanism. If any of these includes themselves contain multiple DNS lookups, you can quickly hit the limit.
