SPF flattening for enterprise. Stay under 10 DNS lookups.

Dynamic SPF flattening service for enterprise IT teams.

Publish one EasySPF TXT record for the domain Reduce lookup-limit PermError with dynamic flattening Refresh flattened provider IP ranges as source DNS changes Manage authorized SPF sources from one interface

Talk to sales

Start free trial

No Credit Card Required

Recognized as a Leader by Experts

Compliant with Industry Standards

90,000+ organizations trust EasyDMARC worldwide

Check your SPF record

Available in Premium and Enterprise plans

Learn More About SPF Check

Six reasons SPF gets harder to operate at scale.

SPF has a hard evaluation limit, while every sender, nested dependency, provider change, and manual edit adds another condition to manage.

The 10-lookup limit is closer than it looks.

Nested SPF includes count toward the same evaluation limit
Exceeding the RFC limit returns SPF PermError

Every new sender adds SPF dependencies.

A sending service can introduce another include or authorized IP range
The top-level record may hide additional lookups inside nested includes

Static SPF flattening can go stale.

Provider IP ranges can change after they have been copied into DNS
A hard-coded flattened record does not update itself when the provider changes its SPF infrastructure

Old authorization is easy to leave behind.

Retired services can remain represented in SPF long after the business stops using them
The DNS record alone does not explain whether a source is still owned, required, or safe to remove

Manual SPF edits create avoidable failure modes.

Duplicate SPF records, malformed terms, or incorrect values can invalidate or change SPF evaluation
Long records and nested dependency chains become harder to review safely

SPF pass is not the same as DMARC alignment.

SPF authenticates the MAIL FROM / Return-Path identity, not automatically the visible From domain
To satisfy DMARC through SPF, authentication must pass and the domains must align

Aligned DKIM can still satisfy DMARC when SPF does not.

One DNS setup. Ongoing control.

Centralized SPF management lets your team control authorized sending sources without repeatedly editing the raw TXT record. After publishing the EasySPF-provided SPF record, supported source changes are managed through EasySPF and reflected through the dynamic SPF configuration.

Centralized source management

Manage authorized SPF sources from one interface.

Review the sources represented in the domain's SPF policy, add supported sending services or custom SPF values, and keep source context in one managed view. EasySPF can also identify entries already present in an existing SPF record when the domain is added.

Existing SPF entries surfaced during setup
Recognized providers labeled where EasyDMARC can identify them
Add supported include sources and authorized IP ranges
Enable, disable, update, or rename managed sources
SPF capability information available for supported senders

EasySPF sender inventory for a domain with active and inactive sources

Lookup limit protection

Dynamic SPF flattening keeps you under 10 lookups.

EasySPF resolves configured SPF include dependencies into direct IP ranges, reducing DNS-querying terms in the evaluated record. The service monitors configured source infrastructure and refreshes the flattened IP ranges when those providers update their published SPF data.

Reduce nested include lookup pressure
Refresh flattened IP ranges as configured provider DNS changes
Keep source-level SPF capability visible
Avoid maintaining static flattened IP lists by hand

Flattened SPF record preview showing DNS lookup count and generated IP ranges

Guided SPF management

Change SPF sources without editing the raw TXT string.

Use structured source fields instead of manually rebuilding the complete SPF record for routine changes. EasySPF generates the managed SPF configuration from the sources you maintain in the interface.

Add supported source types through structured fields
Validate source values before saving where supported
Reduce manual SPF syntax handling
Review the resulting raw SPF configuration when needed

EasySPF source update form with validation and sender settings

Change accountability

Keep a searchable history of EasySPF changes.

EasyDMARC Audit Logs record important EasySPF configuration actions so administrators can review who changed a source, what action was taken, and when it happened. Audit-log retention depends on the customer's plan.

Added, removed, and updated SPF sources recorded
SPF source value and type changes recorded
Enable and disable actions recorded
Search and filtering available through Audit Logs
Retention varies by plan

SPF change history with user attribution, timestamps, and configuration changes

What changes when SPF is managed.

Illustration representing centralized management of SPF sources through EasySPF

Operations

Less DNS work for routine SPF changes.

Publish the EasySPF-provided record during activation.
Manage supported sources from one interface afterward.
Review existing SPF entries before activation.
Keep source names and configuration together.

Illustration representing dynamic SPF flattening protecting against DNS lookup limit failures

Authentication resilience

Reduce SPF failures caused by lookup pressure and stale flattening.

Dynamic flattening reduces DNS-querying terms.
Configured provider IP ranges are refreshed as source DNS changes.
SPF capability helps identify senders that can or cannot rely on SPF alignment.
Direct SPF evidence remains separate from inbox-placement or reputation evidence.

Illustration representing SPF as an authentication path toward Managed DMARC enforcement

DMARC readiness

Keep the SPF path reliable where DMARC depends on it.

Maintain SPF authorization for legitimate configured sources.
Understand whether a sender is SPF-alignment capable.
Use aligned SPF as one possible authentication path toward Managed DMARC enforcement.
Use Managed DKIM where DKIM is the appropriate alignment path.
Review aggregate evidence in DMARC reporting and monitoring after changes.

Works with the sending services already in your SPF environment.

EasySPF manages SPF authorization centrally while your mail platforms continue sending exactly where they already operate.

Sender setup support

Use provider-specific EasyDMARC guidance to configure SPF and authentication for common sending services.

Microsoft 365

Google Workspace

SendGrid

Amazon SES

Mailgun

Salesforce ActiveCampaign Constant Contact + more sender guides

Custom SPF sources

Add other legitimate sending infrastructure using the SPF details provided by the service or system you operate.

SPF include IPv4 range IPv6 range Custom source Source label

Looking for the wider platform integration catalog?

Explore EasyDMARC integrations across DNS, security, identity, receiver data, MSP workflows, and more.

Explore all integrations

Keep a clear record of SPF changes.

EasyDMARC Audit Logs preserve timestamped EasySPF configuration activity, helping administrators investigate changes and support internal change-control reviews.

Who changed it

User and activity attribution where available.

What changed

Source added, removed, updated, enabled, disabled, or changed.

When it changed

Timestamped activity with searchable, filterable history.

Audit-log availability and retention depend on plan. Verify our security and compliance controls in the Trust Center.

What customers say.

We had so many senders that didn't fit into SPF DNS text records. The field length was too long and we had to leave some out. The EasySPF feature of EasyDMARC was a no-brainer for us and one of the best things we ever did to get all of our senders authorized.

William Schellhaas

VP of Technology Infrastructure at Crunch

What is managed SPF and how does EasySPF work?

EasySPF is EasyDMARC's managed SPF service. Publish one EasySPF-provided TXT record, then manage authorized sending sources, either recognized providers or custom SPF values, from the EasyDMARC dashboard instead of editing DNS directly. EasySPF generates the SPF configuration from the sources maintained in the interface.

How does EasySPF solve the SPF 10-lookup limit?

EasySPF dynamically flattens configured SPF includes into direct IP ranges, reducing the number of DNS-querying mechanisms in the evaluated record. It monitors the underlying provider infrastructure and refreshes the flattened IP ranges when a provider's published SPF data changes, so the record doesn't go stale.

Is EasySPF an SPF flattening tool or a managed SPF service?

Both. Dynamic SPF flattening is one capability within EasySPF's broader managed SPF service, which also includes centralized source management, existing-record detection, and a searchable Audit Log of every configuration change.

Do I need DMARC to use EasySPF?

No. EasySPF can be used to manage SPF independently. When DMARC is deployed, SPF can satisfy one DMARC authentication path only when SPF passes and the authenticated MAIL FROM domain aligns with the visible From domain. DMARC can also pass through aligned DKIM, so EasySPF does not guarantee DMARC compliance by itself.