SPF flattening: when it helps and what can go wrong

What it means

An SPF record may trigger at most 10 DNS lookups. Each include: counts, and so do the includes hidden inside it. With several services, you quickly reach 11 or more, and SPF returns an error (permerror).

Flattening means replacing the includes by the IP addresses they point to. For example:

Before: v=spf1 include:_spf.example-provider.com ~all
After:  v=spf1 ip4:198.51.100.0/24 ip4:203.0.113.0/24 ~all

ip4: and ip6: entries cost no lookup, so the record is now well under the limit.

Why it matters

Flattening solves the lookup problem, but brings new risks:

• Providers change their IP addresses. Google, Microsoft and newsletter tools add servers regularly. A flattened copy does not follow. New servers fail SPF without any warning.
• Records get long. Big providers have dozens of ranges. A very long SPF record must be split into several strings and may exceed DNS size limits.
• Nobody remembers. A year later, nobody knows where the IP addresses came from or which one can be removed.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF, DMARC and MX records without sending anything.

The SPF line in the report and the scanner tell you if your record is valid or exceeds 10 lookups.

How to fix it

1. Try the simple fixes first

• Remove includes for services you no longer use.
• Remove duplicates, such as a and mx when they point to servers that do not send email.
• Check whether a tool really needs an include. Many newsletter tools use their own return path domain, so SPF is checked there, not on your main domain.
• Move bulk senders to a subdomain like news.yourdomain.com, with its own SPF record.

2. If you still need flattening, flatten only part

Keep the includes for big providers that change often (your mailbox provider), and flatten only small, stable services whose addresses rarely change, such as your own server.

3. Prefer an automatic service

Some DNS or DMARC services offer "dynamic" flattening: they check the providers' IP addresses every day and update the record for you. If you flatten by hand, set a monthly reminder to compare your list with the provider's current one.

4. Keep DKIM working

Even if SPF breaks after a change, a valid DKIM signature keeps DMARC passing. Make sure every service signs with DKIM for your domain.

Check that it is fixed

Run the Domain scanner again: your SPF record should be valid and under 10 lookups. Then send a test email from each service to a new Delivmail test address and check that SPF passes. Repeat these tests every few months if you flattened by hand.