SPF flattening: fix the 10-lookup limit for good
If your SPF record uses more than 10 DNS lookups, receiving mail servers
return a permerror and your email quietly starts failing authentication.
SPF flattening collapses all those lookups into direct IP addresses so your
record passes again — and a self-healing approach keeps it working even as your providers
change their sending IPs.
Test your SPF record and see your lookup count →
What is SPF flattening?
SPF flattening is the process of replacing the include,
a, mx, and redirect mechanisms in your SPF record with
the actual ip4: and ip6: ranges they resolve to. Because raw IP
mechanisms don’t count toward SPF’s lookup limit, a flattened record can authorize
unlimited senders while staying at zero lookups — eliminating the
permerror caused by
too many DNS lookups.
SPF is validated by counting DNS-lookup-causing mechanisms. Per RFC 7208 §4.6.4, evaluating a record may trigger at most 10 of these:
includeamxptr(deprecated — avoid)existsredirect
ip4:, ip6:, all, and exp do
not count. Crucially, each include can contain its own nested
includes, and every lookup in that tree counts — so a handful of legitimate
providers compounds past 10 fast. There is also a separate limit of 2 “void”
lookups (mechanisms that resolve to nothing); exceeding either produces a
permerror.
The three ways to fix too many SPF lookups
There are only three real strategies for getting an over-limit SPF record back under 10 lookups. Each has trade-offs:
1. Prune
Remove senders you no longer use — a self-referential
include of your own domain, a dead GoDaddy or 1&1 host, an old
marketing tool. Free and zero-maintenance, but it only works if
your real, active senders already fit inside 10 lookups.
2. Flatten
Replace each include: with the actual ip4: and
ip6: ranges it resolves to. IP mechanisms don’t count against
the limit, so a flattened record can hold unlimited senders in
zero lookups. The catch: it’s a static snapshot
— when a provider changes its sending IPs, a hand-flattened record silently
breaks mail until someone updates it.
3. Macros / exists
A single exists: mechanism (1 lookup) that checks the sending IP
dynamically against a DNS zone. Unlimited senders, one lookup, and it
updates itself when providers change — the modern, self-healing fix.
This is what a managed SPF service automates.
The practical takeaway: pruning is great when it’s enough. Beyond that, static flattening trades one silent-failure mode for another, which is why the reliable answer for most domains is a managed, self-healing record — flattening (or macros) kept continuously in sync so it never goes stale.
Why static flattening isn’t enough
Flattening by hand solves the lookup count today, but it freezes your providers’ IP
addresses into your record. When Microsoft, Google, or your CRM rotates its sending IPs —
which they do regularly — your static record no longer lists the new IPs, and mail from
those IPs starts failing SPF. You’ve traded a loud permerror for a
silent deliverability leak.
The reliable answer is a managed, self-healing record: you point your domain at a hosted record once, and it is monitored and re-flattened automatically whenever an upstream provider changes. You get the single-lookup result without the brittleness. See how SPF macros make flattening self-healing, or compare SPF flattening tools.
Start here
Too many SPF lookups?
Understand the 10-lookup limit and what’s eating your budget.
Getting an SPF permerror?
Diagnose and fix the exact error receivers are returning.
How flattening works
The mechanics, step by step, with real record examples.
Provider setup guides
Microsoft 365, Google Workspace, GoDaddy, SendGrid and more.
Frequently asked questions
What is SPF flattening?
include, a, mx, redirect) with the resolved ip4:/ip6: ranges, so the record authorizes the same senders using zero DNS lookups and no longer trips the 10-lookup limit.Is SPF flattening safe?
How many DNS lookups is SPF allowed?
permerror.