FREE TOOL BY WARMY.IO

SPF Checker & Flattener

Q: What is SPF flattening?

Flattening swaps include terms for the IP addresses they point to, so the record needs no extra lookups. It clears PermError right away.

Q: Are there risks to flattening?

Yes. Providers change their sending IPs, and a flattened record doesn't follow those changes. If your email platform adds a new range and your record still lists the old one, mail from that range fails SPF. Re-check flattened records at least once a month, or flatten only the includes that push you over the limit and leave the rest as they are.

Q: Why does SPF matter more now?

Gmail and Yahoo now require SPF or DKIM to pass and align for DMARC, and bulk senders need both. A broken SPF record used to cost a few points in a spam filter. Now it can get mail rejected.

Q: Can I have two SPF records?

No. Two v=spf1 records on the same domain cause PermError. Merge them into one record.

Q: Is ~all or -all better?

With DMARC enforced, both work. ~all (soft fail) is the safer default while you're still finding all your senders. -all (hard fail) tells receivers to reject unlisted senders outright. Never publish +all, which allows anyone to send as you.

Q: How do I fix SPF PermError?

Find the cause in the lookup tree. If you're over 10 lookups, remove includes for services you no longer use, then flatten what's left or move bulk senders to a subdomain. If the error is a syntax problem or a second SPF record, the result points to the exact part to change. After you publish the fix, run the check again.

Q: How many include mechanisms can an SPF record have?

There's no fixed number of includes. The limit is 10 lookups in total, and one include can use several. Some providers' includes nest three or four more.

Q: What happens to a flattened record when a provider changes its IPs?

Mail sent from the new IPs fails SPF until you update the record. If DKIM still passes and aligns, DMARC will pass and most mail gets through, but you lose the backup that SPF gives you. This is why a flattened record needs regular re-checks.

Q: Does SPF alone protect my domain from spoofing?

No. SPF checks the hidden return-path domain, which a spoofer can set to anything. It's DMARC that ties SPF and DKIM to the From address people see, and only an enforced DMARC policy stops spoofed mail.

Check any SPF record against the 10-DNS-lookup limit, see the full lookup tree, catch the PermError before Gmail does, and flatten it to one valid record in one click.

✓Full lookup tree
✓One-click flattening
✓No sign-up needed

4.9/5 on G2Trusted by 7,000+ businesses

Trusted by teams that live in the inbox

7,000+

Businesses warming up with Warmy

4.9/5

Average rating on G2

98%

Average inbox placement reached

24/7

Human deliverability support

How it works

Fix SPF PermError for good

01
Enter your domain
We fetch your SPF record and every include inside it.
02
See the lookup tree
Every nested include and its lookup count, at a glance.
03
Catch the errors
PermError, +all, duplicates and broken includes flagged.
04
Flatten in one click
Copy a lookup-free record of IP addresses.

How SPF lookups work and when to flatten your SPF record

SPF lists the servers allowed to send mail for your domain. The record itself is short, but every include in it can pull in more records, and receivers stop counting at 10 DNS lookups. The SPF checker above shows that whole tree, which is usually where the problem hides.

SPF syntax and the 10 DNS lookup limit

Part	Example	Uses a DNS lookup
ip4 / ip6	ip4:192.0.2.10	No
include	include:_spf.google.com	Yes, plus every lookup inside it
a / mx	a, mx	Yes
exists, redirect, ptr	redirect=_spf.example.com	Yes (ptr is deprecated)
all	~all or -all	No

Qualifiers set the result: -all means fail, ~all means soft fail, ?all is neutral and +all lets anyone send as you, which you should never publish. A record over 10 lookups returns PermError, and most receivers treat that as a failed SPF check. There's a second limit too: more than two lookups that return nothing (void lookups) also break the record.

Why you get "too many DNS lookups"

The count grows quietly. A team adds Google Workspace for mailboxes, a marketing platform, a CRM, a help desk and an invoicing tool, and each vendor asks for its own include. Some of those includes nest three or four more. Nobody sees the total until mail starts failing. Look through the lookup tree for services you no longer use and remove them first; it's the cheapest fix.

SPF flattening: benefits and risks

SPF flattening replaces includes with the IP addresses they resolve to, so the record uses zero lookups. It works, with one catch: providers change their IP ranges without notice, and a flattened record doesn't update itself. Re-check it at least monthly. A cleaner long-term option is to move each bulk sender to its own subdomain (news.yourdomain.com, billing.yourdomain.com), where every subdomain gets a separate SPF record and its own 10 lookups.

Other SPF errors the checker catches

Two SPF records on one domain are invalid, and receivers fail both every time, so merge them into one. A TXT string longer than 255 characters has to be split into several quoted strings, and some DNS panels cut it silently instead. A typo in an include domain turns into a void lookup that counts against your limit and authorises nothing. The ptr mechanism is deprecated and slow, so replace it with ip4 or include. If you're on Microsoft 365, our guide to setting up an Office 365 SPF record shows the correct form, and SPF alignment issues explains why a passing SPF can still fail DMARC.

Next step after you fix SPF

Starting from scratch? Build a clean record with the SPF Generator. SPF alone doesn't protect your domain, so check DKIM with the DKIM Checker and confirm your DMARC policy next. Warmy monitors SPF, DKIM and DMARC every day and alerts you when a vendor change breaks your record.

Stop finding SPF errors after the campaign. Try Warmy free for 7 days or book a demo.

Get a 7-Day Trial Book a Demo

Why Warmy

Everything Deliverability
In One Platform

One platform, one subscription, one team, no add-ons, no extra vendors.

Scale & people

1M+ real mailboxes - The largest warm-up network — genuine Workspace, Microsoft 365 and consumer inboxes.
A dedicated success manager - A named expert who owns your placement outcomes, not a ticket queue.
24/7 support, VIP channels - Real people any hour, in your own Slack, WhatsApp or Teams channel.
120+ deliverability specialists - The largest team in the category, dedicated to inbox placement.
An in-house research team - Continuous experiments on how Gmail, Outlook and Yahoo filter this month.
Recognised experts - Specialists who advise on sender reputation daily — not generalists.

Technology

Adeline AI co-pilot - Reads your tests, DNS and warm-up data, then tells you what to fix next.
The infrastructure behind other tools - Outreach platforms and ESPs run their warm-up on our API.
One loop: test, warm, fix - Placement tests, warm-up, monitoring and fixes in a single platform.
500K+ US seed accounts - Real inboxes across major, corporate and regional providers — mobile included.
Monthly seed rotation - Aging mailboxes retire automatically, so your data comes from live inboxes.
Automation built in - n8n, Zapier, Make and a documented API — no CSVs, no manual seed files.

Included in every plan

Email verification - Clean lists before you send, so bounces never cost you reputation.
DMARC tracker - SPF, DKIM and DMARC monitoring with the exact record to change.
Deliverability tester - Instant placement, authentication and blacklist check for any sender.
Templates AI optimizer - Your campaign scored and rewritten for the inbox before you send.
Reputation tracker - Domain and IP reputation with blacklist alerts the moment a signal drops.
Google Postmaster built in - Postmaster data beside your warm-up and placement results.
Working-hours warm-up - Natural business-hours sending in the recipient’s time zone.
A robust API - Every feature available over documented endpoints.

No extra vendors, no add-on fees, no separate contracts.

Loved By Thousands Of Marketers Around The World

Over 7,000 Businesses Trust Warmy

FAQ

SPF Checker
Questions, Answered

What is the SPF 10-lookup limit?

When a receiver checks your SPF record, it can follow at most 10 DNS lookups. The include, a, mx, ptr, exists and redirect terms each use one, and so does everything nested inside your providers' includes. Go over 10 and SPF returns PermError, which most receivers treat as a fail.

What is SPF flattening?

Are there risks to flattening?

Why does SPF matter more now?

Can I have two SPF records?

Is ~all or -all better?

How do I fix SPF PermError?

How many include mechanisms can an SPF record have?

What happens to a flattened record when a provider changes its IPs?

Does SPF alone protect my domain from spoofing?

Get started

SPF Fixed?
Now Build The Reputation That Lands In The Inbox

Get a 7-Day Trial Book a Demo

No Credit Card Required | Cancel Anytime

Keep going

More Free Tools

Everything you need to send emails that look great and land in the inbox.

4.9/5 on G2

Recognized By The People Who Use Us

Award-winning on G2, season after season

A white and teal triangle with black text.

SPF Checker & Flattener

Fix SPF PermError for good

Enter your domain

See the lookup tree

Catch the errors

Flatten in one click