SPF flattening vs includes: tradeoffs, failure modes, and safer alternatives

spf

When an SPF record gets close to the 10-lookup limit, teams usually hear the same suggestion: flatten it.

That advice is not wrong, exactly. It is just incomplete.

SPF flattening can reduce lookup depth by replacing include: chains with explicit ip4: and ip6: mechanisms. But it also changes the operational model. Instead of depending on a provider to keep its own SPF data current, the domain owner now has to keep copied IP authorization data current. That tradeoff is where most real-world breakage starts.

If the lookup-limit side of SPF needs a refresher first, keep SPF 10 DNS lookup limit explained nearby while reading this.

What people mean by SPF flattening

SPF flattening is not a formal SPF feature. It is an operational technique.

A normal SPF record might look like this:

example.com. IN TXT "v=spf1 include:_spf.mailer.example.net include:spf.protection.outlook.com -all"

That design delegates sender-IP maintenance to the providers behind those include: targets.

A flattened version replaces those upstream references with explicit IP ranges:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 ip4:198.51.100.0/24 ip6:2001:db8:100::/48 -all"

This can cut DNS-querying terms dramatically, which matters because SPF evaluation has a global limit of 10 lookup-causing terms across the whole evaluation path, per RFC 7208 section 4.6.4.

The catch is obvious once it is stated plainly: flattened records age.

Why teams flatten SPF in the first place

There are usually three motivations:

  1. The record is near or over the SPF lookup budget.
  2. The DNS response is getting large and hard to reason about.
  3. Admins want a single visible list of authorized sending IPs.

Those are all understandable. RFC 7208 explicitly tells publishers to keep the amount of DNS information needed for evaluation to a minimum, and it also warns about oversized TXT responses and DNS transport issues in section 3.4.

So the instinct behind flattening is often healthy: make SPF smaller, simpler, and more predictable.

The real tradeoff: delegation versus copied state

Maintaining include: mechanisms means delegating part of SPF maintenance to the service you use.

That has benefits:

  • the provider can rotate IPs without asking you to edit DNS every time
  • failover pools and new outbound ranges can be added upstream
  • your record stays closer to the provider's supported design

Flattening swaps those benefits for different ones:

  • fewer SPF lookups at evaluation time
  • easier inspection of the final authorized-IP list
  • less dependence on nested third-party SPF trees during message checks

Neither model is universally correct.

The question is not "is flattening good or bad?" It is "who is more likely to keep authorization data accurate over time: the provider, or the local automation and change process?"

Where flattening breaks in production

1) Upstream provider IP changes silently invalidate your copy

This is the classic failure mode.

An ESP, CRM platform, or ticketing system adds new outbound IP space, retires an old pool, or shifts traffic between regions. Their published SPF include changes. Your flattened copy does not.

Now legitimate mail starts producing SPF failures or SPF permerror elsewhere in the graph. If DKIM is missing or not aligned on that stream, DMARC can fail too, because DMARC needs at least one aligned authentication pass from SPF or DKIM, as described in RFC 7489 section 4.2.

This is why flattening often looks successful right up until the day it does not.

2) Flattening can create records that are large, brittle, or both

Reducing lookup terms does not automatically produce a healthy SPF record.

A heavily flattened record can become long enough to be awkward to publish, review, and troubleshoot. RFC 7208 recommends keeping published SPF data small enough that query results fit within traditional UDP response limits, and specifically notes the risk of oversized answers and TCP fallback issues in section 3.4.

So flattening can solve one limit while pushing you toward another operational edge.

3) The record stops matching the provider's documented setup

Many providers publish support documentation that assumes their include: domain remains in place. Microsoft, for example, documents include:spf.protection.outlook.com in Microsoft 365 SPF guidance and recommends subdomains for external services that are not under direct control.

Once a provider-specific include: is replaced with copied IP ranges, troubleshooting with vendor support becomes harder. The first question is often whether the supported SPF record is still published. If the answer is no, the burden of proof shifts back to the domain owner.

4) Manual flattening goes stale faster than people expect

Some teams flatten SPF once during an incident and then never revisit it.

That turns SPF into configuration debt. Months later, nobody remembers where the copied ranges came from, which ones belong to which sender, or which business system would break if one line were removed.

The record may still "work" for the busiest sources and still be wrong for the less visible ones.

5) DNS changes can briefly disagree with messages already in transit

RFC 7208 notes that when SPF records are changed, there should be a transition period so the old policy remains valid long enough for legitimate mail that is already in transit to be checked under the expected policy. This matters for all SPF changes, but it matters even more when flattening creates larger, more frequent record rewrites.

Small, repeated authorization edits are not free.

Where keeping includes breaks down

Includes are not magically safe either.

They become a problem when teams keep stacking vendors into one root-domain SPF record until it turns into a dependency graph nobody can audit. That is how domains hit the 10-lookup limit, inherit nested includes they do not understand, and end up with SPF permerror.

Includes are also risky when the sender inventory is unclear. Old vendors often stay authorized long after they stop sending.

So this is not a case of "includes good, flattening bad". It is usually a case of "unsegmented sender architecture bad".

A safer way to decide

Use this rule of thumb:

  • keep provider-managed include: entries when the provider changes infrastructure dynamically and publishes a supported SPF include for that purpose
  • use explicit ip4: or ip6: only for sources under direct control or for very stable ranges with a clear owner
  • avoid stuffing every sender into one apex-domain SPF record if those streams can be separated by subdomain

That last point matters most. A surprising number of SPF problems are really domain-design problems.

For example:

  • example.com for employee and core transactional mail
  • marketing.example.com for campaign platforms
  • support.example.com for ticketing systems
  • alerts.example.com for product notifications

That approach reduces lookup pressure, reduces blast radius, and makes it much easier to know which team owns which authorization path.

Microsoft's guidance explicitly recommends subdomains for email services that are not under direct control, which lines up with what tends to work best operationally.

Safer alternatives to full flattening

1) Remove stale includes first

This is the highest-value cleanup step.

Before flattening anything, verify which platforms still send mail. Old ESPs, HR systems, event tools, and support desks are often still in SPF long after migration.

Deleting one dead include is better than flattening five live ones.

2) Split mail streams onto dedicated subdomains

If one record is carrying too many unrelated services, segmentation is usually cleaner than flattening.

It also improves reputation isolation and troubleshooting. A broken marketing sender should not force emergency SPF edits for employee mail on the organizational domain.

3) Prefer DKIM alignment as the long-term stability anchor

SPF is path-based and tied to the envelope sender domain. DKIM is usually more resilient to infrastructure changes because the signed domain can remain stable even when IPs or outbound relays move.

That does not mean SPF can be ignored. It means the safest posture is usually:

  • valid SPF
  • aligned DKIM on every important stream
  • DMARC monitoring to catch drift early

If one sender's SPF design is operationally messy, solid DKIM alignment keeps that stream from becoming a DMARC single point of failure.

4) Use selective flattening, not blanket flattening

Sometimes partial flattening is sensible.

If one source is a stable in-house relay with fixed ranges, publishing those IPs directly may be cleaner than another include. Meanwhile, dynamic providers can stay as includes.

That hybrid model often gets the lookup count down without creating a fully copied third-party dependency map in your DNS.

5) If flattening is automated, treat it like generated configuration

Automated flattening is much safer than manual copy-and-paste, but only if it has controls:

  • refresh on a predictable schedule
  • alert on upstream changes
  • preserve a clear mapping from IPs to source system
  • validate final record size and lookup behavior
  • test with live mail after updates

Without those controls, "automated flattening" is just stale SPF at higher speed.

A practical comparison

Includes-first approach

Best when:

  • the provider publishes and supports an SPF include
  • the provider's infrastructure changes regularly
  • you want vendor-managed IP maintenance

Main risk:

  • nested lookup growth and hidden complexity

Flattened approach

Best when:

  • the source IPs are stable and well owned
  • automation keeps copied ranges current
  • lookup reduction is genuinely necessary

Main risk:

  • authorization drift when upstream IPs change

Subdomain segmentation approach

Best when:

  • many unrelated senders are sharing one domain
  • different teams or vendors own different streams
  • the root problem is architecture, not only lookup count

Main benefit:

  • simpler SPF per stream, lower blast radius, better DMARC operations

What to do before changing anything

Work through this short checklist:

  1. Inventory every sender currently using the domain.
  2. Identify which senders are under direct control and which are vendor-managed.
  3. Count lookup-causing SPF terms recursively.
  4. Remove stale senders before redesigning live ones.
  5. Decide whether the right fix is subdomain segmentation, selective flattening, or no flattening at all.
  6. Confirm DKIM alignment for each live stream.
  7. Roll out SPF changes with enough transition time to avoid breaking mail already in flight.

For the DMARC side of the decision, DMARC alignment: From vs Return-Path is the right companion post.

Bottom line

SPF flattening is a tool, not a best practice by itself.

Use it when it reduces real risk and when someone, preferably automation, can keep the copied data current. If the real issue is too many unrelated senders sharing one domain, flattening is usually treating the symptom.

The safest default is usually this: keep supported provider includes, segment mail by subdomain, remove stale senders aggressively, and reserve flattening for stable or tightly managed cases.

Previous PostNext Post