What is a spf flattening?
SPF flattening replaces include mechanisms with the IP ranges they resolve to, so a record stays under SPF's ten-DNS-lookup limit. It works because ip4 and ip6 mechanisms are evaluated inline and cost no lookup, but it moves the burden of tracking provider IP changes onto you.
The limit is the problem being solved. Each include, a, mx, ptr and exists mechanism costs one of ten permitted lookups, and exceeding ten makes the entire record fail with a permanent error rather than ignoring the surplus. Google Workspace alone costs three.
Flattening trades a lookup problem for a maintenance problem. Providers change their sending ranges without notice, and a flattened record that has gone stale silently fails authentication for mail that should pass. A hand-flattened record is a time bomb; a managed flattening service keeps it current for a fee.
Prefer the cheaper fixes first: remove vendors you no longer send through, and authorise your own servers by IP rather than by include. Flatten only when the record genuinely cannot fit.
Last reviewed 2026-09-11