Reference

SPF flattening: when it helps and when it breaks your SPF record

What SPF flattening does, when Microsoft says it is reasonable or risky, how to maintain a flattened record, and what to try before you flatten.

By Updated Last verified

On this page
  1. Why flattening reduces lookups
  2. When flattening is reasonable
  3. When not to flatten
  4. If you flatten, maintain it
  5. Try these first: subdomains and fewer senders
  6. Count your real lookups
  7. Sources

SPF flattening (opens in a new tab) means replacing include: mechanisms in your SPF (Sender Policy Framework) record with the IP addresses they resolve to, so the record needs fewer DNS lookups. Microsoft considers it appropriate for non-Microsoft vendors with stable, documented IP ranges, or when you are near or over the 10-lookup limit (opens in a new tab) and other strategies such as subdomains or consolidation aren't feasible. It also says not to flatten its own include, because its sending IP addresses change frequently.

Why flattening reduces lookups

RFC 7208 (opens in a new tab) caps SPF evaluation at 10 terms that cause DNS queries: the include, a, mx, ptr and exists mechanisms and the redirect modifier. Past 10, the result is a permerror. The ip4, ip6 and all mechanisms do not cause DNS queries.

Each include (opens in a new tab) triggers a recursive evaluation, so the lookups inside it count too. Microsoft (opens in a new tab) notes that nested includes add lookups beyond the direct ones, so having fewer than 10 include: statements doesn't guarantee fewer than 10 lookups. Swapping an include for its ip4: and ip6: values removes those lookups.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

When flattening is reasonable

Microsoft's SPF guide (opens in a new tab) lists when flattening is appropriate:

  • vendors (other than Microsoft) with stable, documented IP address ranges;
  • services that rarely change their sending IP addresses;
  • when you are approaching or over the 10-lookup limit and other strategies, such as subdomains or consolidation, aren't feasible.

When not to flatten

The same guide says not to flatten Microsoft 365 (include:spf.protection.outlook.com), because Microsoft's sending infrastructure uses dynamic IP addresses that change frequently, or any cloud service with dynamic or frequently changing IPs. Microsoft's guidance (opens in a new tab) is the source for both.

For a sense of what a flattened copy would hold: checked against live DNS, spf.protection.outlook.com currently lists ip4 and ip6 ranges and ends with -all.

If you flatten, maintain it

Microsoft (opens in a new tab) sets out the upkeep:

  1. Document which include: entries you replaced and when.
  2. Monitor vendor documentation for IP address changes.
  3. Review and update the flattened entries at least quarterly.
  4. Test SPF validation after each change.

Microsoft also notes that third-party flattening services can automate tracking vendor IP changes and updating your record.

Try these first: subdomains and fewer senders

Microsoft's guide (opens in a new tab) lists two other ways to cut lookups:

  • Use subdomains. Move non-Microsoft email services to subdomains, for example marketing.example.com for marketing email with its own SPF record. Each subdomain has its own 10-lookup budget.
  • Consolidate. Where possible, reduce the number of non-Microsoft services that send email from your domain.

For the lookup error itself, see SPF too many DNS lookups; for Microsoft 365's records, see Microsoft 365 SPF, DKIM and DMARC.

Count your real lookups

The check only reads the public DNS records of the domain you enter. It counts lookups including the includes nested inside, and flags a record that is close to or over the 10-lookup limit. The SPF record generator estimates lookups for the services you pick, before you publish.

Sources

Tools for this

Frequently asked questions

What is SPF flattening?

Replacing include: mechanisms in your SPF record with the IP addresses they resolve to, so the record needs fewer DNS lookups.

When is SPF flattening appropriate?

Microsoft lists vendors with stable, documented IP ranges, when you are near the 10-lookup limit and subdomains or consolidation aren't feasible. If you flatten, monitor vendors for IP changes and review the flattened entries at least quarterly.

Should I flatten Microsoft 365's SPF include?

No. Microsoft says not to flatten include:spf.protection.outlook.com, because Microsoft's sending infrastructure uses dynamic IP addresses that change frequently.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account