SPF flattening that fixes the 10-lookup limit
Too many includes push your SPF record past the 10-DNS-lookup limit and it fails with a permerror. SPF flattening resolves those includes to the IP addresses they authorise, and a hosted, dynamic SPF record keeps you under the limit as your senders change.
DNS-lookup limit flattening keeps you under
Includes resolved to the addresses they allow
Re-flattened as sender IPs change
What is SPF flattening?
SPF flattening is the process of resolving every include: in your SPF record down to the actual IP addresses it authorises, then publishing those addresses directly. An ordinary record delegates to a provider’s own list (include:_spf.google.com, for example), and each of those delegations costs a DNS lookup. A flattened record skips the delegation and lists the resolved ip4: and ip6: ranges instead, so the receiver has far fewer lookups to follow.
The point of flattening is a single, valid SPF record that authorises exactly the same senders while sitting comfortably under the 10-lookup limit. It is the most reliable way to fix a record that has grown too large, without dropping any of the services you genuinely send from.
Before and after, in short
- Before: a stack of
include:mechanisms, each spending part of your lookup budget - After: resolved
ip4:andip6:ranges, well under 10 lookups - Same senders authorised, no service left out
- One record you publish, kept current for you
SPF too many DNS lookups, and the permerror it triggers
The SPF standard allows a receiving server only 10 DNS lookups while it evaluates your record. Every include:, a, mx and redirect mechanism spends part of that budget, and a single include can pull in several more lookups behind the scenes. Add one cloud tool too many and you tip over the edge.
When you cross the SPF permerror / 10 lookup limit, SPF does not simply ignore the extra senders: the whole record returns a permerror, and many receivers treat that as if you had no SPF at all. It fails silently, so legitimate mail starts failing authentication and nobody changed anything obvious. To fix “SPF too many DNS lookups” you need to bring the lookup count back under 10, and that is exactly what flattening does.
Why the limit is so easy to blow
- Each
include:can cost more than one lookup - Providers change their own lists, so your count drifts on its own
- Adding one new tool can be the include that tips you over
- A
permerroris invisible unless something is watching for it
How to flatten an SPF record safely
You could flatten an SPF record by hand: resolve every include to its current IP addresses, paste them into one record, and publish. The trouble is that those IPs are not fixed. Providers add and retire sending servers constantly, so a record you flatten today quietly goes stale, and a hard-coded list can start rejecting mail the provider has legitimately moved to a new address. Flattening once is easy; keeping a flattened record correct is the real work.
Resolve
DMARCER reads your record the way a receiver would, follows every include, and collects the real ip4: and ip6: ranges each one authorises.
Publish
You point a single include at DMARCER and we serve the flattened record, so one line in your DNS replaces the stack that was pushing you over the limit.
Maintain
We re-resolve your senders and republish the record automatically as their IPs move, so the flattened record never goes stale and never starts rejecting legitimate mail.
A dynamic SPF record, not a one-off flatten
A static flattened record is a snapshot, and snapshots rot. A dynamic SPF record is one that DMARCER re-resolves and republishes on your behalf whenever your senders’ underlying IP addresses change, so it stays flat, valid and current without you editing DNS by hand. You get the lookup savings of flattening without the maintenance burden that makes hand-flattening so risky.
If an upstream sender goes dark and stops resolving to any IPs, DMARCER notices rather than silently dropping it, so a vanished sender is surfaced to you instead of quietly disappearing from your record.
- Re-resolved and republished automatically as IPs change
- Stays under the 10-lookup limit as you add senders
- Drift detection flags a sender that stops resolving
- No hand-edited record going stale behind your back
Previewed before it publishes, and fully reversible
Flattening changes live DNS, so nothing happens blindly. Before anything goes live you see the exact flattened record DMARCER will publish, your original record is snapshotted and retained, and one click hands back an equivalent record to revert. There is no lock-in: choosing to flatten and host your SPF with DMARCER is a decision you can always reverse. See hosted SPF →
Keep exploring
Hosted SPF →
Let DMARCER host and maintain the flattened record.
What is SPF? →
SPF explained, including the lookup-limit trap.
SPF checker →
Check your record and lookup count in seconds, free.
The 10-lookup limit →
Why the limit breaks more domains than anything else.
SPF flattening: common questions
What is SPF flattening?
SPF flattening resolves each include: in your SPF record down to the actual IP addresses it authorises, then publishes those addresses directly, so the record stays under the SPF 10-DNS-lookup limit instead of spending that budget on nested lookups. It authorises exactly the same senders, just in a form a receiver can evaluate without running out of lookups.
How do I flatten an SPF record?
To flatten an SPF record you resolve every include to its current IP ranges and publish those instead. Doing it by hand goes stale as providers change their IPs. DMARCER flattens the record for you, hosts it behind a single include, and re-resolves it automatically so it stays correct.
How do I fix “SPF too many DNS lookups” or a permerror?
The error means your SPF record needs more than 10 DNS lookups to evaluate, so receivers return a permerror and treat SPF as failed. Flattening the record collapses those lookups to IP addresses and brings you back under the 10-lookup limit, and a hosted, dynamic record keeps you there as you add senders.
What is a dynamic SPF record?
A dynamic SPF record is a flattened, hosted record that DMARCER re-resolves and republishes automatically as your senders’ underlying IP addresses change, so it stays flat, valid and current without you editing DNS by hand.
Is SPF flattening safe and reversible?
Yes. You see the exact record before it publishes, your original SPF record is snapshotted and retained, and one click hands back an equivalent record to revert. There is no lock-in, and drift detection flags any sender that stops resolving.
How many lookups is your SPF using?
Run a free check to see your SPF record and lookup count, then flatten and host it with DMARCER and stop worrying about the limit.
Check your domain