SPF Record Flattener

SPF (Sender Policy Framework) has a hard limit of 10 DNS lookups per record. Every include:, a:, mx:, and redirect= mechanism requires at least one DNS lookup, and nested includes add more. When your SPF record exceeds the 10-lookup limit, receiving servers return a "permerror" result, which means your SPF authentication fails entirely. This tool resolves all your includes to their underlying IP addresses, creating a flattened record that uses zero DNS lookups.

Why SPF records exceed the 10-lookup limit

Modern businesses use many email services: Google Workspace, Microsoft 365, Salesforce, HubSpot, Mailchimp, and more. Each service requires its own include: in your SPF record, and many of those includes contain nested includes themselves. It is not uncommon for a business to need 15-20 DNS lookups, well over the limit. Flattening solves this by replacing includes with the actual IP addresses they resolve to.

How flattening works

The tool resolves each include: mechanism recursively, following nested includes until it reaches the final IP addresses. It then replaces all the include mechanisms with direct ip4: and ip6: entries. The resulting record requires zero DNS lookups because all addresses are specified directly.

Use with other SPF tools

Before flattening, check your current SPF configuration with our SPF checker. If you are setting up SPF for the first time, use the SPF generator to create a properly formatted record. After flattening, verify the new record works correctly by checking it again. Also ensure your DKIM and DMARC are properly configured since they work together as a complete email authentication framework.

SPF flattening is a critical deliverability optimization. Monitor your overall email security posture with the domain reputation checker and use the DNS propagation checker to verify changes have propagated after updating your SPF record.