wiredepth
Run a check

Free tool · Email auth

SPF flattener

Resolve nested SPF include: directives recursively. Returns a flat record with ip4: / ip6: entries only - 0 DNS lookups, always validates within RFC 7208's 10-lookup cap. No signup.

What this tool checks

We resolve every include: directive in your SPF record recursively, walking nested includes until we reach the leaf ip4: / ip6: entries. Then we return a flat record with all the IP ranges inlined - zero DNS lookups required at receive time, and guaranteed to stay under the RFC 7208 10-lookup cap.

We deduplicate IP ranges across includes (Microsoft 365 and SendGrid both ship overlapping ranges in some configurations) and surface the count so you know how compact the result is. Most flattened records land between 200 and 400 bytes - well under the 512-byte SPF practical limit.

We also report the per-include lookup cost BEFORE flattening, so you can see exactly which includes are eating your budget. Common offenders: _spf.google.com (4 lookups when nested), spf.protection.outlook.com (3), sendgrid.net (2-3), mailgun.org (2).

How to read the results

When to flatten:

  • Your SPF check fails with "PermError: too many DNS lookups".
  • Recipients silently quarantine your mail with spf=permerror in the Authentication-Results header.
  • You added a new vendor (e.g. SendGrid, Mailgun, Customer.io) and want to know how many lookups they'll cost before committing.

Trade-offs: A flattened record stops following upstream changes. When SendGrid rotates their sending IPs your record won't pick it up automatically. You either re-flatten on a schedule or you live with the 10-lookup limit and rely on subdomain delegation. Wiredepth Pro monitors flattened records continuously and alerts when an upstream source changes its IPs.

Frequently asked questions

Why does SPF have a 10-lookup limit?

RFC 7208 caps SPF evaluation at 10 DNS lookups to prevent recursive denial-of-service attacks on receiving MTAs. Exceed it and the receiver returns PermError, which DMARC alignment treats as a fail. The cap is practically the most common email-deliverability gotcha.

Is flattening safe?

Functionally yes - the resolved IPs are the same ones the include: would have returned at evaluation time. The risk is staleness: your record stops following upstream changes. Mitigation is monitoring + periodic re-flattening when an upstream's IP space shifts.

How often should I re-flatten?

Depends on your senders. Google Workspace IPs change rarely (months); SendGrid / Mailgun shift more often (weeks). A monthly re-flatten cadence catches most upstream shifts. Wiredepth Pro automates this - re-checks daily, alerts on diff.

What's an alternative to flattening?

Subdomain delegation: send marketing mail from email.acme.com, transactional from notify.acme.com, etc. Each subdomain has its own SPF, and lookup limits apply per-domain. Cleaner architecturally but requires changing your sender addresses and DKIM signing.

Does flattening break DKIM?

No - DKIM is independent of SPF. Flattening only modifies the SPF record. DKIM signatures continue to validate normally as long as the signing key is still published.

Related free tools