SPF Flattening Explained: Automate Your SPF to Prevent PermError

Published August 31, 2026 · 5 min read · spFlat! Blog

As your business grows, so does the number of third-party platforms sending emails on your behalf. Between Google Workspace, Microsoft 365, Mailchimp, and your CRM, your SPF (Sender Policy Framework) record can quickly become bloated.

Before you know it, you hit the strict 10-DNS-lookup limit imposed by the SPF protocol. When this happens, receiving servers will reject your emails with an SPF PermError. The solution? SPF flattening.

In this guide, we'll explain what it means to flatten an SPF record, the risks of doing it manually, and how an automated SPF flattening tool can save your deliverability.

What is SPF PermError vs. SPF TempError?

If you are wondering what is SPF PermError, it is a permanent error that occurs when a receiving mail server cannot correctly evaluate your SPF record because it requires more than 10 DNS lookups to resolve. Every include: mechanism in your record counts towards this limit. Once you exceed 10, the check halts permanently, and your email is treated as unauthenticated.

Another related issue is an SPF TempError. While PermError is a hard limit violation, a TempError (Temporary Error) occurs when a DNS lookup times out during evaluation. Complex, deeply nested SPF chains are much more likely to cause DNS timeouts, meaning a bloated record can trigger both PermErrors and TempErrors.

What is SPF Flattening?

SPF flattening is the process of resolving all the domains and include: statements in your SPF record into their underlying IP addresses (IPv4 and IPv6). By replacing DNS lookups with direct IP addresses, you bypass the 10-lookup limit entirely.

For example, instead of writing include:_spf.google.com (which internally triggers multiple additional lookups), an SPF flattener replaces it with the actual IP blocks Google uses to send mail.

Advanced SPF record flattening also involves SPF flattening compression optimization. This means the tool merges overlapping IP ranges and CIDR blocks to keep the final TXT record as short and efficient as possible, ensuring you don't hit the character length limits of DNS records.

Why Manual Flattening is a Bad Idea

It is possible to flatten an SPF record manually using command-line tools. However, doing so introduces a massive risk: cloud providers change their IP addresses constantly.

If Microsoft or Mailgun adds a new IP range and you have manually hardcoded their old IPs into your DNS, your emails will immediately start failing authentication and bouncing. You would have to manually monitor and update your records every week.

What cloud services automate SPF include optimisation to reduce lookup count?

Because manual updates are risky and time-consuming, IT administrators often search for: what cloud services automate SPF include optimisation to reduce lookup count?

The answer is an SPF flattening service that provides dynamic, real-time updates. This is exactly where automation SPF flattening comes into play. Instead of hardcoding IPs, you use a service that continuously monitors the sending infrastructure of your vendors.

When you use an automated SPF flattening tool like SPFlat!, the service handles the heavy lifting:

• Continuous Monitoring: SPFlat! polls the DNS records of your included vendors 24/7.
• Automatic Updates: Whenever a vendor like Google or Salesforce changes their IP ranges, SPFlat! instantly updates your flattened record.
• Compression Optimization: Overlapping IP addresses are merged to keep your DNS payload small and fast to query.

How to Fix Your SPF Record Today

Don't let a PermError SPF failure ruin your email deliverability and marketing campaigns. Moving to an automated SPF flattening service takes less than five minutes:

1. Use our free checker to see how many lookups your current record requires.
2. Sign up for SPFlat! and input your desired include: statements.
3. Replace your bloated SPF record with a single, dynamically updated SPFlat! include.

With proper SPF flattening services, you can add as many third-party email senders as your business needs without ever worrying about the 10-lookup limit again.