An SPF record can trigger at most 10 DNS lookups. Past that, SPF fails with a permanent error, and DMARC loses one of its two legs. Flattening is a way to cut the count.
How it works
An include: points at another domain’s SPF record, which may include more. Each step is a lookup. Flattening resolves those includes ahead of time and writes the resulting IP ranges straight into your record:
before: v=spf1 include:_spf.example-crm.com include:amazonses.com ~all
after: v=spf1 ip4:203.0.113.0/24 ip4:198.51.100.0/24 ~allThe flattened record needs no lookups for those entries, so it fits easily.
The risk
Senders move. If example-crm.com adds a new IP range and your flattened record does not, mail from the new range fails SPF and nobody tells you. A flattened record is only safe when something refreshes it automatically. Done by hand it is a trap that goes off months later.
Better first steps
- Remove senders you no longer use. Most records hold at least one dead include.
- Move third-party senders to their own subdomains, each with a small record of its own.
- For Amazon SES, use a custom MAIL FROM domain. The SES SPF record then sits on a subdomain and does not count against the lookups on your main domain.
Flatten as a last resort, with automatic refreshing, not as a first fix. The SPF entry has the basics.
Common questions
Is flattening a good idea?
Only if the flattened record is kept up to date automatically. Providers change their IP addresses, and a stale flattened record silently blocks their mail.
Do I need to flatten SPF for Amazon SES?
Usually not. With a custom MAIL FROM domain, SES's SPF record lives on that subdomain, so it does not use any lookups from your main domain's record.