SPF Flattener
Flatten an SPF record
Try:
github.com
microsoft.com
shopify.com
Tool features
4 features
Full-tree resolution
Expands every include and redirect and resolves a and mx mechanisms to their A and AAAA addresses.
Before / after lookup count
Counts lookups the way receivers do, including nested includes and void lookups, for the live and flattened record.
Keep chosen includes
Keep any provider as include: and the flattened record and lookup count update instantly.
CIDR merging and splitting
Dedupes and merges overlapping ranges, then splits the result into TXT records that fit in a DNS answer.
What is SPF flattening & how it works
Every include:, a, mx, ptr, exists: and redirect= in an SPF record costs a DNS lookup, and so does everything nested inside the includes. RFC 7208 caps the total at 10. Past that, receivers stop and return permerror — SPF fails for every message, and DMARC loses SPF alignment with it.
Flattening resolves those mechanisms ahead of time and publishes the IP ranges they point at as ip4:/ip6: terms, which cost no lookups. This tool walks the whole tree, inlines only the includes that can be inlined without changing what the record authorises, merges overlapping ranges, and splits the result into TXT records that fit in a DNS answer.
permerror
The SPF result for a broken record — including one over the 10-lookup limit.
Void lookup
A query that returns nothing; more than two can also cause permerror.
Part record
An extra TXT record (e.g. _spf1.example.com) holding ranges that did not fit in the main one.
How to use this tool
1
Enter your domain
Type the domain whose SPF record you want to flatten, e.g.
example.com.2
Flatten the record
The tool resolves every include, a and mx in the live record and counts the lookups before and after.
3
Choose what to keep
On the Includes tab, keep providers whose IPs change often as include: — the record updates as you toggle.
4
Publish and re-check
Publish the part records first, then the main record, and re-run the flattener every month to catch provider IP changes.
Related tools
5 tools
SPF Lookup
Check Sender Policy Framework (SPF) records for email authentication and mail server authorization
SPF Validator
Validate SPF record syntax and check for configuration errors and best practices
SPF Generator
Generate SPF records to authorize mail servers for your domain with visual builder
DMARC Lookup
Check DMARC policy records for email authentication, reporting, and policy enforcement
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records
Frequently asked questions
5 Q&A
It authorises the same servers on the day you flatten, but it is a snapshot. When a provider adds sending IPs, mail from them fails SPF until you re-flatten. Keep fast-changing providers as include: when the lookup budget allows, and re-run the flattener regularly.
Includes that use macros (like %{i}), exists: or ptr depend on the connecting IP or the message, so there is nothing fixed to resolve. Includes with non-pass terms such as -ip4 can also change the result when inlined. The tool keeps all of these as include: rather than guess.
Long records risk DNS answers over 512 bytes, which some receivers handle badly. The ranges are moved into part records such as _spf1.example.com that the main record includes. Each part costs one lookup, so choose a larger length if you want fewer parts.
Ten, counted across the whole tree: include, a, mx, ptr, exists and redirect each cost one, including those nested inside included records. ip4, ip6 and all cost nothing. Separately, more than two lookups that return no answer can also cause permerror.