SPF permits ten DNS lookups during evaluation. Each include costs one, and the includes inside those records count too, so a domain with five sending platforms can cross the limit without anyone doing anything unusual.
Cross it and the result is permerror. Under a DMARC reject policy that becomes rejected mail, so the pressure to fix it quickly is real.
Flattening is the tempting answer. Resolve every include, take the addresses out, and write them into your record as ip4 mechanisms, which cost no lookups. The record evaluates cleanly and the problem appears solved.
It is solved until a vendor changes their IP ranges, which they do without telling you because the whole point of publishing an include is that they can. Your record now authorizes addresses they no longer use and omits the ones they do. Mail from a system nobody has touched starts failing SPF and there is no change on your side to correlate it with.
What to do instead
Remove senders you no longer use. Most records over the limit carry a platform somebody stopped using two years ago, and this step alone fixes a good share of cases.
Move a sender onto a subdomain. Marketing mail from news.example.com gets its own SPF record and a fresh ten-lookup budget, and your root record loses that include entirely. This is the best answer and it is not a workaround.
Use ip4 ranges only where a vendor publishes a stable set and documents it as stable. Some do; treat that as a specific arrangement rather than a general technique.
If you flatten anyway, automate the refresh and alert on the diff. An unmonitored flattened record is the version that breaks, and the breakage arrives weeks after anyone remembers doing it.
Where this argument costs us something
The short version
- Audit your includes before reaching for a flattener, because a dead vendor is usually in there.
- Prefer subdomain delegation, which solves the problem rather than deferring it.
- Never hand-flatten without monitoring, since the failure is silent and delayed.
Questions people ask
Why is the SPF lookup limit ten?
To stop SPF evaluation being used as a denial-of-service amplifier. A receiver will not chase an unbounded chain of DNS queries for one message.
Do ip4 mechanisms count toward the limit?
No. Only mechanisms requiring a DNS query count. That is exactly why flattening works and exactly why it goes stale.