What is SPF flattening and when should you avoid it?

SPF flattening is what it sounds like. You take an SPF record full of include statements and replace them with the actual IP addresses those includes would resolve to. The result is one long record of ip4: and ip6: ranges, zero nested lookups, and plenty of headroom under the 10-lookup limit.

It's popular because the 10-lookup cap catches a lot of senders who use more than 2 or 3 third-party services. Flattening makes the problem disappear... until it doesn't.

When flattening helps

And If your SPF record is at or over 10 lookups and you can't reduce the includes, flattening buys you compliance. Several tools (EasyDMARC, Valimail, DMARC Report) rewrite the record for you and host an auto-refreshing version you include instead of the original.

When to avoid it

Flatten only when the IP ranges you're flattening are stable. That's the whole trick. Most providers publish their SPF record so they can rotate, add, or remove IPs over time. Flattening freezes that snapshot, and if you don't refresh it, legitimate mail silently starts failing.

Avoid flattening when:

• The provider rotates IPs often. Google Workspace, Microsoft 365, and most large ESPs change their sending IPs regularly. A flat snapshot goes stale in weeks.
• You're doing it manually and you'll forget to refresh. If you don't have an auto-updating flattener, don't do this by hand. You will forget. Mail will fail. It'll be invisible until complaints roll in.
• You have fewer than 10 lookups. You don't need it. Keep the record readable and let providers manage their own changes.

The better path, most of the time

But Most senders don't actually need to flatten. They need to audit. Use our SPF checker to see exactly which includes exist and how many lookups each one eats. Remove the senders you don't use anymore. That usually drops you back under 10 without any flattening at all.

If you're stuck between "too many lookups" and "can't trust a flattener," the SOS hotline is free.