8 minutes reading
If you’ve ever sent marketing emails, newsletters, or transactional messages from your domain and noticed that they end up in spam folders, SPF (Sender Policy Framework) is one term you should get familiar with. Even more specifically, SPF flattening.
In this blog, we’ll get an overall understanding of SPF flattening. We’ll share what it is, why it is critical for email delivery, and how to use it to ensure your domain remains credible.
What is SPF?
The Sender Policy Framework (SPF) is an email authentication method that allows domain owners to specify the IP addresses which are allowed to send email from the domain in question on behalf of an account. This specification is done by creating an SPF record that is placed in the domain’s DNS settings.
An SPF record shields your domain against spammers phishing actors that send fraudulent emails through your domain. It also has an important role to play in your ability to have emails received in inboxes rather than being labeled as spam.
Why SPF Isn’t Always Enough?
To determine whether the sending server has the authorization to send email, SPF works by looking up DNS records. SPF has a fairly finite limit: there are only 10 DNS lookups allowed per verification. In other words, if your SPF record references too many external domains that include statements, you are likely to reach the limit fairly quickly.
When you go over this limit, even legitimate emails can fail SPF checks, leading to deliverability problems.
This is where SPF flattening becomes important.
Book a Free Demo Call with Our People Security Expert
Enter your details
What is SPF Flattening?
Sender Policy Framework (SPF) flattening is a proven approach used by many to simplify their SPF record by replacing include: statements with their resolved IP addresses. This limits DNS lookups and keeps you under the limit of your SPF record.
Imagine this flattening as decluttering your DNS instructions. Rather than sending email servers on a hunt to check multiple records, you’re giving them everything up front, like a direct cheat sheet.
For example:
Before Flattening:
- v=spf1 include:_spf.google.com include:mailgun.org ~all
After Flattening:
- v=spf1 ip4:192.0.2.1 ip4:203.0.113.2 ip4:198.51.100.3 ~all
Before flattening, the SPF record used included mechanisms to reference external domains. After flattening, these were replaced with specific IPv4 addresses, removing the need for DNS lookups. This change reduces the need for DNS lookups. It might look messier, but it’s more efficient for email servers.
Why Does SPF Flattening Matter?
- Avoid SPF Failures: Flattening can help keep you under the 10 lookup limit, therefore avoiding SPF validation errors.
- Enhances Email Deliverability: In case your SPF is good enough, you have higher chances of receiving your email in the inbox rather than spam.
- Futureproofing: Your SPF record may become pretty cluttered if you use a couple of third-party services like Google Workspace, Mailchimp, SendGrid, or Hubspot.
- Security: It helps maintain tighter control over which IPs can send emails on your behalf, minimizing spoofing risks.
Practical Steps to Flatten Your SPF Record
Flattening your SPF isn’t difficult, but it needs attention to detail. Here’s a practical, step-by-step approach:
Step 1: Review Your Current SPF Record
Log in to your domain registrar (like GoDaddy, Namecheap, or Cloudflare) and check your current SPF TXT record.
Step 2: Count DNS Lookups
Use tools like:
- Threatcop SPF Checker
They show how many DNS lookups your SPF record is currently making. It’s approaching or surpassing 10, you’ve got to flatten.
Step 3: Resolve Included Domains to IPs
This is the core of flattening. Each includes: refers to another domain. You can use tools like dig or DNS lookup services to extract the IP addresses from those includes.
Step 4: Rewrite the SPF Record
Once you’ve gathered all IPs, rewrite your SPF record, replacing include: entries with the actual ip4: or ip6: entries.
Step 5: Replace the Existing Record in DNS
You should now update your DNS using the new, flattened SPF record. Be careful, however, not to exceed the DNS character limits (255 characters per string, and 512 total for DNS responses).
Automation: Use an SPF Flattener Tool
Manual flattening is feasible, but not always practical, especially for businesses using multiple email services.
That’s where tools like:
- MxToolbox SPF Flattening Tool: Automatically reconstructs your SPF record, reducing DNS lookups and maintaining compliance.
- Safe SPF: Allows dynamic SPF record flattening, as your SPF is changed, it will also update your SPF record.
- AutoSPF: Delivers automatic SPF flattening by condensing all domains that are within the SPF and also eliminating more DNS lookups.
- EasySPF: Utilizes a dynamic SPF flattening algorithm to swap domain includes with IP addresses, ensuring your record is up to date.
After automating the process, you can also check your updated SPF record using the SPF Record Checker to ensure everything is configured correctly.
These tools:
- Automatically resolve includes into IPs
- Monitor changes and keep your SPF updated
- Alert you if the record gets too long or goes over the lookup limit
Some services even offer dynamic flattening, which updates your DNS record daily based on real-time changes to IPs used by third parties.
What Could Happen If You Don’t Flatten Your SPF Records?
- Email Failures: Exceeding the 10-lookup limit can cause SPF validation failures, preventing emails from reaching inboxes.
- Increased Spam Risk: Unflattened SPF records may lead to emails being marked as spam by email servers, reducing deliverability.
- Rejection by Receiving Servers: Emails may be outright rejected if SPF checks exceed the DNS lookup limit.
- Frustrating Customer Communication: If emails are flagged as spam or rejected, communication with customers can be delayed or missed.
- Damage to Domain Reputation: Continuously failing SPF checks can harm your domain’s reputation, affecting future email deliverability.
Best Practices for SPF Flattening
- Regular Monitoring: Even with the use of automated tools, review your SPF record from time to time to confirm accuracy and adherence.
- Combine with Other Authentication Protocols: Integrate SPF with DKIM and DMARC to boost email security and e-deliverability.
- Avoid Over-Authorization: Only include necessary IP addresses in your SPF record to minimize security risks.
Avoid These Common Mistakes
- Using too many include: entries without flattening
- Forgetting to update flattened IPs when providers change infrastructure
- Mixing includes: with flattened IPs and exceeding the limit
- Omitting the ~all or -all directive at the end of your SPF record
Final Thoughts
SPF is crucial for email security and deliverability, but it comes with strict limitations. As more businesses use multiple third-party email services, the risk of hitting the DNS lookup limit grows.
SPF flattening is a simple yet powerful technique that keeps your SPF record efficient, trustworthy, and under control. Whether you’re managing one domain or dozens, flattening your SPF record ensures your emails actually reach the inbox.
Want to secure your domain and maintain a healthy sender reputation? TDMARC helps you secure your domain and outbound email, ensuring domain reputation and email deliverability, giving you peace of mind and reducing manual SPF management hassles.
FAQs
Q: 1. What happens if you don’t flatten SPF records?
If you go over 10 DNS lookups in your SPF record, your email can fail authentication even if it is accurate. This usually sees your emails flagged as spam or outright rejected by receiving servers.
2. Is it safe to replace include statements with IP addresses?
Yes, flattening your SPF by replacing includes with IPs is safe, but you must keep the IPs updated. If the provider changes their sending IPs, your SPF record could become outdated, so regular maintenance or using a dynamic SPF flattener is key.
3. Can you automate SPF flattening for multiple domains?
Absolutely, with many SPF flattener tools offering automation features. They can dynamically update SPF records across multiple domains and alert you to changes, helping reduce manual workload and maintain deliverability.
