SPF Flattening — Managing Complex Email Infrastructure in 2025

The SPF specification limits DNS lookups to 10 per record check. As organisations add more email services (Mailchimp, Salesforce, HubSpot, Google Workspace, transactional email), hitting this limit causes legitimate email to fail.

Diagnosing the Problem

# Check how many DNS lookups your SPF uses
dig TXT yourdomain.com | grep spf

# Use online tools to count lookups
# https://mxtoolbox.com/spf.aspx
# Look for "PermError: too many DNS lookups"

Understanding SPF Lookup Limits

# Each of these counts as a lookup:
include:    # +1 lookup (plus recurses into that record)
a:          # +1 lookup
mx:         # +1 lookup
ptr:        # +1 lookup (avoid using ptr)
exists:     # +1 lookup

# These do NOT count as lookups:
ip4:1.2.3.4     # direct IP, no lookup
ip6:2001:db8::  # direct IPv6, no lookup

SPF Flattening Solution

# Before flattening (8 lookups, near limit)
"v=spf1 include:_spf.google.com include:sendgrid.net include:mailchimp.com include:salesforce.com ~all"

# After flattening (0 lookups, resolves all IPs)
"v=spf1 ip4:1.2.3.4 ip4:5.6.7.8 ip4:9.10.11.12 ... ~all"

Automated SPF Flattening Tools

• dmarcly.com — automated dynamic SPF
• autospf.com — free flattening tool
• easydmarc.com — full email authentication suite

Dynamic SPF — The Long-Term Solution

Dynamic SPF uses CNAME redirects to a managed record that automatically updates when sending service IPs change — no manual maintenance required.

Conclusion

SPF management is increasingly complex in 2025. Our team handles complete email authentication setup including SPF flattening for complex environments.