SPF Flattening Tools: A Practical Buying Guide
Summarize with AI
The best SPF flattening tool keeps sender ranges current, removes stale authorization, alerts on unsafe change, preserves history, and supports rollback and export. Static flattening can solve today's lookup count and create tomorrow's authentication failure if nobody refreshes it.
Start With the Actual SPF Limits
SPF tells receiving systems which hosts are authorized to use a domain in the SMTP identity being evaluated. Its limit is about DNS work during evaluation, not simply the number of visible include: statements.
RFC 7208 section 4.6.4 says implementations must limit the total number of lookup-causing terms to 10. The counted terms are include, a, mx, ptr, exists, and redirect. Exceeding the limit requires a permerror result. The RFC also recommends a two-void-lookup limit, where a query returns no answers or a name error; exceeding that limit also produces permerror.
ip4, ip6, and all do not cause DNS queries during SPF evaluation and are not subject to the ten-term limit. That is the opening flattening uses: resolve indirect authorization into explicit IP ranges before a receiver evaluates the record.
Record size still matters. RFC 7208 section 3.4 says the published SPF record should remain small enough for the query result to fit within 512 octets and gives a guideline of under 450 octets for the DNS name plus text records. A tool that eliminates lookups by publishing an unwieldy answer has not finished the job.
Understand What Flattening Changes
Traditional SPF often delegates authorization to a provider:
include:_spf.provider.example
A flattening process resolves that provider's SPF path and publishes the resulting IPv4 and IPv6 ranges directly. The receiving system compares the connecting address with those ranges rather than following the original chain of includes.
That reduces lookup pressure but transfers responsibility. A provider can change its own include; a static flattened copy retains old ranges until somebody republishes it.
Two failures become possible:
- Missing new authorization: the provider adds a sending range, but your copy does not. Legitimate mail from the new range can fail SPF.
- Retaining stale authorization: the provider removes a range, but your copy keeps it. Your domain continues authorizing infrastructure the provider no longer says to authorize.
A credible tool must manage both directions. Adding addresses without removing retired ones is unsafe.
Decide Whether You Need Flattening at All
Do not buy a flattening service merely because a checker displays a large number. Inventory every sender, trace the evaluated SPF path, remove services the business no longer uses, and consider whether separate mail streams should use controlled subdomains.
For each service, record the sending domain, mail stream, authorization source, business owner, last verification date, and removal procedure. That inventory exposes abandoned authorization and preserves the reason each sender remains approved.
Flattening is useful when necessary services still make evaluation exceed or approach the lookup limit and restructuring is not enough. It should not preserve old senders more efficiently.
Our view: sender removal is the first SPF optimization. A tool should not be paid to flatten authorization nobody can justify.
Compare AutoSPF and Red Sift by Scope
AutoSPF is a dedicated SPF management option with public pricing. Its pricing page lists Plus at $37 per month for one domain and one user, Premium at $97 for five domains and five users, and Enterprise at $387 for ten domains and 25 users. It lists additional domains at $10 per month each on Plus and Premium and $20 each on Enterprise.
The same page says every tier provides automatic SPF flattening, macro SPF management, unlimited monthly email volume, a DNS rescan every 15 minutes, rollback, audit logs, and API access. Treat the 15-minute interval as AutoSPF's published claim and verify observed behavior in a trial. Feature inclusion represented by icons should also be confirmed in the current order form.
AutoSPF's flattening explainer describes resolving lookup-driven mechanisms into ip4 and ip6 entries and says the service rescans every 15 minutes. The page also advertises versioned records, rollback, staging, and drift alerts. Those are useful evaluation targets; they are not independent proof of reliability.
Red Sift OnDMARC is broader. Its public product page positions Dynamic SPF inside an email-authentication platform that also covers DMARC, DKIM, BIMI, MTA-STS, reporting, and policy management. Red Sift says Dynamic SPF authenticates approved senders through a single dynamic include and flattens records at query time without manual DNS updates or macros. The page does not publish a comparable self-serve price, so obtain a written quote.
The choice is partly scope. A team needing targeted SPF relief may favor a dedicated product; one procuring DMARC workflow and managed authentication across a larger estate may prefer a platform. Compare equivalent controls, not one public subscription against an undefined enterprise package.
Make Refresh and Drift the Core Test
Ask each vendor to demonstrate what happens when an upstream provider changes its SPF record. A slide that says "automatic" is not enough.
Use a controlled test domain and upstream policy you own. Add an approved range, then remove it. Capture:
- When the upstream DNS change became visible
- When the tool detected it
- The proposed or published policy diff
- Whether an alert fired and to whom
- Whether the new range was authorized
- Whether the removed range stopped being authorized
- Whether the resulting SPF stayed within lookup and size guidance
Also make the upstream record unavailable or return a void response. The tool should not replace a known-good policy with an empty result. Ask about retries, last-known-good behavior, partial failure, and escalation.
A refresh frequency is only one part of the answer. The safer product combines timely detection with validation, bounded publishing, and evidence an operator can inspect.
Require Alerts That Support a Decision
"SPF changed" is not actionable. Require the domain, upstream source, ranges added and removed, detection time, publication status, validation result, and owner. Distinguish a routine provider update from a failed refresh or an authorization added outside the managed path.
Define severity before launch:
- Information: valid upstream change detected and safely published
- Review: unexpected new range, unusually large change, or ownership unknown
- Incident: resulting
permerror, empty resolution, failed publication, record-size risk, or rollback activation
Route alerts to an operational destination with an owner and preserve the DNS diff and validation result. Also disconnect a credential or block publication during testing; the system should report that it can no longer protect the domain.
Test Rollback as a Real Recovery Procedure
Rollback needs more than a button. Ask what state is restored, how DNS time-to-live affects recovery, and whether automation pauses so the bad version is not immediately recreated.
Run the procedure during the trial: save the known-good policy, publish an approved test change, trigger rollback, query authoritative DNS, validate from outside the vendor dashboard, and inspect the audit log. Confirm automation resumes only through the documented approval path.
Keep an emergency DNS procedure outside the product. If the vendor, identity provider, or integration is unavailable, an authorized person should still know how to restore a safe record without waiting for vendor access to return.
Demand export and a clean exit.
A managed SPF tool becomes infrastructure. Before purchase, request an export of domains, source includes, current flattened ranges, version history, alerts, owners, validation results, and audit events. Confirm the format and whether it is available without professional services.
Ask what remains in DNS if the subscription ends. A hosted vendor include creates a different exit dependency from software that publishes into DNS you control. Neither model is automatically wrong, but the transition must be explicit.
Price the exit:
exit work = policy export + independent validation + replacement setup + DNS change + overlap monitoring
Require retention and deletion terms, credential revocation, and a list of domains still pointing to vendor infrastructure. The business should own its domains, DNS accounts, sender inventory, and recovery copy.
The SPF Flattening Tool Decision
Shortlist products only after cleaning the sender inventory and confirming that the RFC lookup limit remains a real constraint. Then score refresh behavior, stale-range removal, failure handling, alerts, rollback, record size, access control, audit history, export, and commercial terms.
AutoSPF offers a transparent starting point with public monthly tiers and a published 15-minute rescan claim. Red Sift OnDMARC offers Dynamic SPF in a broader authentication and DMARC operating environment with quote-based procurement. The better choice is the one that passes your controlled drift and recovery tests at the scope you actually need.
Do not accept "flattened" as the finish line. The safe state is a current, explainable, reversible authorization policy with a named owner.
Review SPF in the Context of Your Sending System
We can map your domains, mail streams, sender ownership, and authentication controls to the campaign you plan to run during a free ICP and campaign-fit discovery call. Book your free ICP and campaign-fit discovery call →
Frequently Asked Questions
A strong positive reply rate for B2B cold email is 1.5–3%. Top-performing campaigns with tight targeting and personalized copy can hit 4–5%. If you're below 1%, it usually signals a deliverability or messaging problem, not a volume problem.
The safe range is 30–50 emails per inbox per day for warmed inboxes. That's why outbound systems use multiple inboxes (we use 80) to reach 40,000+ monthly sends while keeping each inbox well within safe limits. Sending more than 50/day from a single inbox risks spam folder placement.
Yes. The CAN-SPAM Act permits unsolicited commercial email as long as you include a physical address, an unsubscribe mechanism, accurate headers, and non-deceptive subject lines. Unlike GDPR in Europe, the US does not require prior opt-in consent for B2B cold outreach.
Domain warm-up typically takes 2–3 weeks. During this period, sending volume gradually increases while the email warm-up tool generates positive engagement signals (opens, replies) to build sender reputation. Skipping or rushing warm-up is the most common cause of deliverability problems.
Cold email is targeted, relevant outreach to a specific person based on their role, industry, or company, with a clear business reason. Spam is untargeted mass messaging with no personalization or relevance. The distinction matters legally (CAN-SPAM compliance) and practically (deliverability depends on relevance signals).
