Back to Tools

SPF Flattener

Parse and flatten an SPF record by resolving all include: mechanisms recursively into a single line.

Enter a domain name to flatten its SPF record
SPF Flattening Results for
Original SPF Record
Flattened SPF Record
Resolved Includes
Statistics
0
DNS Lookups
0
Includes Resolved
0
Warnings

Why SPF flattening exists

SPF evaluation is limited to 10 DNS lookups. Each include, a, mx, ptr, exists, or redirect can consume lookups, especially when several SaaS mail providers are combined.

How to use flattened output

Flattening resolves includes into IP ranges so the published record may need fewer DNS lookups. Treat the result as a snapshot, not a permanent truth.

Example: a record using include:_spf.google.com may expand to several ip4 and ip6 mechanisms controlled by Google.

Risks and common mistakes

  • Flattened records become stale when providers change sending IP ranges.
  • Large records can exceed DNS TXT length limits or become hard to maintain.
  • Flattening SaaS includes can remove the provider's ability to update mail infrastructure transparently.

When not to flatten

If your SPF record is already below the lookup limit, keeping provider includes is usually safer. Flatten only when you understand the maintenance cost and have a process to refresh the record.

Related tools

Use Email Auth Checker, SPF & DMARC Generator, DNS Lookup, and Blacklist Checker for a full email-authentication review.

The SPF 10-Lookup Limit (RFC 7208)

SPF evaluation counts DNS lookups: each include:, a:, mx:, ptr:, and exists: mechanism triggers one lookup. The total across all mechanisms must not exceed 10. If your SPF includes _spf.google.com (3 lookups) + spf.protection.outlook.com (1 lookup) + other services, you can quickly hit the limit. When exceeded, receivers return SPF PermError — which often results in mail rejection.

Flattening resolves all include chains into a direct list of IP networks (ip4:/ip6:), eliminating DNS lookups during SPF evaluation. The tradeoff: you must update the flattened record whenever any included provider changes their IP ranges.

CLI Equivalent

# Count SPF lookups:
dig +short example.com TXT | grep -o "include:" | wc -l
# Resolve an include:
dig +short _spf.google.com TXT