SPF Record Flattener

Overview

The SPF Record Flattener is a specialized diagnostic utility designed to solve one of the most persistent administrative hurdles in email infrastructure management: the strict RFC 7208 limitation of 10 DNS lookups (or "hops") per Sender Policy Framework (SPF) record.

When an organization relies on multiple third-party email vendors—such as Google Workspace, Microsoft 365, Salesforce, Mailchimp, or Zendesk—chaining their respective include: statements together quickly exceeds this 10-lookup threshold. When a mail server encounters an SPF record that exceeds 10 lookups, it evaluates it as a permanent error (permerror), causing legitimate inbound emails to be rejected or severely penalized by spam filters.

This utility automates the process of compressing recursive vendor dependencies into static, direct IP addresses (ip4: and ip6: entries), dramatically reducing your lookup footprint to a single hop while preserving your site's strict security posture.

How It Works: Discovery, Trace, and Flattening

The flattener accepts either a target domain or a raw SPF string. When provided with a domain, the tool performs a comprehensive evaluation:

• Source Discovery: It checks your DNS configuration to determine if a primary unflattened source (a "Shadow Record") exists, falling back to your live production record if necessary.
• Recursive Resolution: It walks down every include:, a:, and mx: mechanism recursively, querying underlying DNS endpoints to harvest every associated IPv4 and IPv6 block.
• Dynamic Macro Preservation: Enterprise vendors frequently utilize dynamic runtime macros (such as exists:%{i}._spf.mta.example.com where %{i} evaluates the connecting sender's live IP address). The flattener automatically detects these dynamic mechanisms and safely passes them through into the final output, ensuring mail delivery pipelines for complex services are never broken.
• Hop Optimization Count: It recalculates your RFC 7208 lookup count, instantly showing you how many hops your record requires before and after optimization.

The Problem with Flattening: Configuration Drift & The Shadow Record Solution

The primary drawback of traditional SPF flattening is the loss of the source of truth. When you replace include:_spf.vendor.com with a block of raw static IP addresses, you lose visibility into why those IPs are there. More importantly, when those vendors inevitably update their server infrastructure down the road, your flattened static record will become outdated, leading to sudden email delivery failures.

To solve this without reverting to a multi-hop nightmare, the SPF Flattener introduces a Shadow Record workflow:

1. Publish a Shadow Record: When you generate your flattened production record, the utility simultaneously formats your original, unflattened multi-vendor string into a designated Shadow Record:

   _unflattened.yourdomain.com IN TXT "v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all"

2. Permanent Source of Truth: By publishing this record as a standard TXT entry under the _unflattened subdomain, your original vendor configurations remain safely stored right inside your DNS zone.
3. Automated Configuration Drift Detection: When you feed your domain back into the SPF Flattener months later, the utility automatically queries for _unflattened.yourdomain.com. It re-runs the resolution trace on that shadow record, compares the newly calculated IPs against your active production record, and instantly alerts you if Configuration Drift is detected. If a vendor has changed their IPs, the tool immediately provides your updated production string so you can copy and paste it into your DNS.

Integrating with the Domain Mail Security Checker (DMSC)

The SPF Flattener is built to work hand-in-hand with the Domain Mail Security Checker.

While the DMSC serves as your primary utility for auditing overall mail posture, TLS cipher policies, DMARC configurations, and flagging when an SPF lookup count creeps past 8 or breaches the critical 10-hop limit—the SPF Flattener serves as the remediation workbench. When DMSC issues a high-hop warning, you can bring that domain straight to the SPF Flattener to compress the record, establish the DNS record for your shadow backup, and secure your email delivery line.