SPF flattener

Replaces the includes in your SPF record with the IP ranges behind them, so a record over 10 lookups passes again.

Reads public records only. Nothing is sent from your domain.Try

Ken keeps an eye on SPF for every domain it sends from.

Connect your domains and Ken watches the lookup count and the rest of your DNS, and pauses an inbox before a send fails.

Start free - 1,000 credits, no card

What the SPF flattener does

Flattening replaces includes with the IP ranges they resolve to. The flattener walks your record, resolves every include, a and mx term down to ip4 and ip6 entries, and writes a record that needs few or no DNS lookups when a receiver evaluates it.

Use it when a record is over the limit of 10 lookups, or close to it, and you can't remove a sender.

The catch: a flattened record goes stale

Providers change their IP ranges without telling you. An include follows the change. A flattened copy doesn't, so the day a provider sends from a range you didn't list, that mail fails SPF.

Flatten only what you must. A common middle path keeps the includes of your main providers and flattens the smaller senders, staying at or under 10. Re-run the flattener on a schedule and whenever a provider announces new ranges.

Flattened records also get long. If the result passes 512 bytes, DNS replies may need TCP, which RFC 7208 advises against. Split the ranges across a few include records on your own subdomains, each costing one lookup.

How to read and publish the result

You get the flattened record, its lookup count and its length. Compare it with the tree from the SPF checker: every range in the tree should appear in the flat record.

Keep a copy of the original record with its includes, publish the flat one in its place, and run the SPF checker again to confirm it resolves.

Why it matters for cold email

Outbound setups pile on senders: a mailbox provider, a sequencer, a CRM, a calendar tool, a help desk. Each asks you to add an include, and one more quietly pushes the record past 10. Then every message fails SPF, including the ones from your main inboxes.

The cleaner fix is often to take senders off the sending domain. A cold email domain only needs its mailbox provider. Flatten when that isn't possible.

Questions

Is SPF flattening safe?

It works, but it's a snapshot. It stays safe if you re-flatten when providers change their ranges. Set it once and forget it, and mail starts failing SPF the day a provider sends from a new range.

How do I fix 'SPF permerror: too many DNS lookups'?

Remove includes for services that no longer send, or that use their own Return-Path domain. Move senders that don't need the root domain to a subdomain with its own record. Flatten what's left only if you're still over 10.

Does flattening affect DKIM or DMARC?

No. It changes only the SPF record. DKIM signatures and your DMARC policy work as before, and DMARC still needs SPF or DKIM to pass and align.

How often should I re-flatten?

Whenever a provider you flattened announces new ranges, and on a fixed schedule as a backstop, such as once a month. Check the result with the SPF checker each time.

Should I flatten Google Workspace's include?

Usually not. include:_spf.google.com costs a single lookup, since Google's record lists its ranges directly, and it follows Google's changes for you. Flatten the senders whose includes nest several more first.