SPF records are limited to 10 DNS lookups. Go over and the entire record fails, which means receiving servers treat your email like it has no SPF at all. Worse, most senders do not know they are over the limit until deliverability tanks. This checklist walks you through auditing and flattening your SPF record. Takes about 10 minutes if you have DNS access.

Before you start

You need DNS access to your domain, your current SPF record (run it through the SPF Checker first), and a list of every service you have authorized to send email as your domain.

Step 1: Map every include

Open your SPF record and list out every mechanism that triggers a DNS lookup.

Write down each include: and what service it belongs to. Example:

include:_spf.google.com        Google Workspace (4 lookups)
include:sendgrid.net           SendGrid (1 lookup)
include:spf.protection.outlook.com Microsoft 365 (2 lookups)
include:servers.mcsv.net       Mailchimp (1 lookup)

Your total so far: add the lookup count for each include, plus nested lookups inside them. The SPF Checker does this automatically.

Step 2: Remove dead includes

Check each include against your actual sending services.

• Do you still use this ESP/service?
• Is it still configured to send from your domain?
• When was the last email sent through it?

Remove any include for a service you no longer use. This is the easiest win. Most domains have at least one stale include from an old marketing tool or transactional service.

Step 3: Replace includes with IP addresses

Static senders (the ones with known, stable IP ranges) can be flattened to direct ip4: or ip6: entries. This eliminates the lookup but keeps the IPs in your record.

Best candidates for flattening: your own mail servers, dedicated IPs at your ESP, transactional services that publish a small static IP list.

Bad candidates: large shared ESPs (Google Workspace, Microsoft 365), services that frequently rotate IPs. Use include: for these so you do not chase IP changes.

Step 4: Consolidate sub-organizations

If different departments use different ESPs (marketing on Klaviyo, support on Zendesk, transactional on Postmark), and you cannot remove any of them, consider using subdomains.

marketing.yourdomain.com gets its own SPF, transactional.yourdomain.com gets its own SPF, etc. Each subdomain has its own 10-lookup budget. This is the only way to scale past 10 with mixed senders.

Step 5: Test before going live

• Run the new record through the SPF Checker
• Confirm the lookup count is under 10
• Send a test email from each authorized service to a Gmail account
• Verify SPF passes in the message headers (Authentication-Results)

Step 6: Update DNS and monitor

Publish the new record. Most DNS providers propagate in minutes. Monitor your DMARC aggregate reports for the next week to confirm SPF alignment stays at pass for every legitimate sender.

Common mistakes to avoid

• Removing an include for a service you forgot about (look at DMARC reports first).
• Flattening a large ESP that rotates IPs.
• Leaving two SPF records on the same domain (only one v=spf1 record is allowed).
• Adding ip4:0.0.0.0/0 as a fallback (this authorizes every IP on the internet).
• Switching from -all to +all to make problems go away (this authorizes the world).

After this checklist

Once SPF is under 10 lookups and passing for every legitimate sender, the next layer is DKIM. Confirm every service signs with DKIM, then check DMARC alignment. The Email Authentication Scorecard walks you through all three on one page.

Built by Review My Emails.