How to flatten an SPF record (step by step)
If pruning didn’t get you under 10 lookups, flattening will. Here’s how to do it correctly — and how to avoid the trap that makes hand-flattened records break later.
The steps
- List every real sender. Mailbox provider, CRM, marketing, help desk, billing — everything that sends as your domain.
- Resolve each mechanism (
include,a,mx) recursively toip4:/ip6:ranges. - De-duplicate overlapping ranges.
- Assemble one record with the IPs and a single
-allor~all, watching the 255-character string limit. - Publish & verify — confirm lookups are under 10 and your real senders still pass.
The trap: staleness
A flattened record is only correct until a provider changes its IPs. When Microsoft, Google,
or your CRM rotates ranges, your static list is wrong and mail from the new IPs fails SPF —
silently, with -all even bouncing it. Hand-flattening therefore needs ongoing
monitoring.
The better way: self-healing
Instead of freezing IPs, delegate the flattening to a hosted record — via one
include or a macro — that is re-resolved
automatically whenever an upstream provider changes. You get a single-lookup, always-current
record with no manual upkeep. See how to choose a tool.
Frequently asked questions
How do I flatten my SPF record manually?
List your senders, resolve each include/a/mx to its IP ranges, de-duplicate, and publish one record of
ip4:/ip6: values ending in -all or ~all — under 10 lookups.Why does my flattened SPF record stop working?
Because it’s a static snapshot. When a provider changes its sending IPs, the frozen list no longer matches and mail fails SPF. A self-healing record avoids this.