Cloudflare SPF Flattening: Why It Doesn't Work Natively & How to Fix It

Published September 21, 2026 · 4 min read · spFlat!

If you are using Cloudflare for your domain's DNS, you already know it is one of the fastest and most robust networks on the internet. Naturally, when IT administrators run into the dreaded SPF 10-lookup limit (the SPF PermError), they often look to Cloudflare settings for a magic "flatten SPF" button.

Unfortunately, Cloudflare does not natively flatten SPF records.

In this article, we explain why Cloudflare's DNS infrastructure doesn't automatically solve the SPF lookup limit, and how you can seamlessly integrate an automated solution like spFlat! directly into your Cloudflare TXT records.

Why Cloudflare Doesn't Natively Flatten SPF

Cloudflare is fundamentally a DNS hosting provider (among its many other security and CDN features). When a receiving mail server (like Gmail or Microsoft 365) asks Cloudflare for your domain's TXT record, Cloudflare simply serves whatever text string you have entered in your dashboard.

SPF flattening is not a DNS feature; it is an email authentication process. To flatten an SPF record, a system needs to:

1. Parse your include: statements (e.g., Google, Mailchimp, Salesforce).
2. Query the DNS of those third-party providers to find their underlying IP addresses.
3. Consolidate those IPs into a new TXT record.
4. Continuously monitor those third-party providers for IP changes.

Cloudflare DNS is designed to be static and lightning-fast. It does not actively traverse the internet to monitor the internal IP changes of Google Workspace or Mailchimp on your behalf. Therefore, if you paste a bloated SPF record with 15 lookups into Cloudflare, Cloudflare will faithfully serve that broken record, resulting in an SPF PermError.

The Risk of "Manual" Flattening in Cloudflare

A common mistake is using a free online tool to resolve all SPF IP addresses once, and then pasting those raw IP addresses (e.g., ip4:209.85.128.0/17) directly into a Cloudflare TXT record.

How spFlat! Integrates with Cloudflare

To get the best of both worlds-Cloudflare's blazing fast DNS and a perfectly valid, dynamically updated SPF record-you need a dedicated SPF flattening service like spFlat!.

Integrating spFlat! with your Cloudflare account takes less than 3 minutes. Here is how it works:

Step 1: Set up your spFlat! account

Instead of putting all your include: statements into Cloudflare, you enter them into the spFlat! dashboard. spFlat! does the heavy lifting: resolving the nested lookups, merging overlapping IP blocks (compression optimization), and monitoring for changes 24/7.

Step 2: Get your unique spFlat! include

Once configured, spFlat! will generate a single, highly optimized include: statement specific to your domain (e.g., include:spf.spflat.cloud).

Step 3: Update your Cloudflare TXT record

Log into your Cloudflare dashboard, navigate to DNS > Records, and edit your existing SPF TXT record. Replace all your bloated includes with the single spFlat! include.

Your old Cloudflare record:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:_spf.salesforce.com ~all

(Result: 14 lookups -> PermError)

Your new Cloudflare record:

v=spf1 include:spf.spflat.cloud ~all

(Result: 1 lookup -> Perfect Deliverability)

Why This is the Smart Approach

By using this setup, Cloudflare continues to do what it does best: serve DNS requests globally in milliseconds. Meanwhile, spFlat! acts as the intelligent engine running in the background.

Whenever Salesforce or Google adds a new sending IP, spFlat! detects it automatically and updates the IPs hosted at spf.spflat.cloud. The next time a receiving mail server checks your Cloudflare DNS, it gets routed to the perfectly flattened, up-to-date IP list. No manual updates required.