Best SPF Flattening Tools Compared: 2026 Pricing Guide

Why SPF records break: the 10 lookup limit

SPF caps DNS lookups at ten per evaluation. Go past it and you get an SPF PermError, which means SPF fails for every message you send. The limit is spelled out in RFC 7208 section 4.6.4.

Ten sounds like plenty. It isn't. Every include: costs a lookup, and most includes contain their own nested includes that spend more of your budget without telling you. Google Workspace, Microsoft 365, Salesforce, HubSpot, SendGrid. Five services and you're done.

The expensive part is how quiet the failure is. Somebody connects a new SaaS tool on a Tuesday, its include takes you to eleven, and legitimate mail starts failing authentication. Nothing in your admin console turns red. You find out three weeks later when a customer mentions your invoice went to spam.

Run your domain through our free SPF record checker before reading further. Seven or eight lookups means this is a problem you'll have soon rather than one you have today.

What SPF flattening actually does, and what it costs you

Flattening resolves every include:, a, mx, and redirect mechanism down to the ip4: and ip6: addresses underneath, then publishes those directly.

# Before — 11 lookups, PermError
v=spf1 include:_spf.google.com include:spf.protection.outlook.com
       include:servers.mcsv.net include:sendgrid.net
       include:_spf.salesforce.com ~all

# After flattening — 0 lookups
v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:40.92.0.0/15
       ip4:198.2.128.0/18 ip4:167.89.0.0/17 ~all

Here's the part most roundups skip. The include: mechanism exists so your providers can change their own infrastructure without involving you. Flatten it and you've quietly taken that job back off them.

AutoSPF counts 23 changes to Google's published SPF includes in a twelve-month span, and 17 to Microsoft's. That's a vendor counting in its own favour, so treat the exact figures lightly. The shape is right, though, and it's the whole problem with flattening: a record you resolved by hand in March is wrong by June, and nothing anywhere will tell you.

So the thing being sold isn't really flattening. It's a service that re-flattens continuously and serves the result, indefinitely, for a monthly fee. We cover the maintenance side in more depth in our guide to SPF record management.

SPF lookup tree showing nested include mechanisms and the lookup count for each

Best SPF flattening tools compared

We sell one of the products below, which you should weigh accordingly. Everything in the table comes from published pricing pages so you can check us against them. Figures verified September 2026.

AutoSPF

The only SPF-only platform here. Plus runs $37 a month for one domain, Premium $97 for five with macros added, Enterprise $387 for ten, and extra domains cost $10 to $20 each. DMARC reporting lives in a separate product, DMARC Report, deliberately kept apart so reporting traffic can't affect SPF uptime. That's a real engineering argument and also two invoices.

PowerDMARC PowerSPF

Cheapest credible way in. Hosted SPF is an add-on to the Basic plan starting at $8 a month, with a 15-day trial and no card required, and it covers macros, automatic updates, and sender visibility inside a full authentication platform. If you want SPF and DMARC from one vendor on an SMB budget, this is the number everyone else has to beat.

EasyDMARC EasySPF

Dynamic flattening with a guided setup, aimed squarely at teams who don't want to think about DNS. No macro support. Under roughly ten sending services it handles the lookup limit without drama, and past that the missing macros start to show.

DMARCLY Safe SPF

Clean interface, readable docs, a perfectly reasonable first platform. Worth knowing before you budget: the cheapest DMARCLY plan is $17.99 a month, but Safe SPF itself doesn't appear until $39.99. Anyone comparing on the headline price will get a surprise at checkout.

Fraudmarc UniversalSPF

Macro-first rather than flattening-first, at $21 per domain per month billed annually. Linear per-domain pricing makes modelling easy, which I appreciate more than it probably deserves. At forty domains the arithmetic stops being charming.

MxToolbox Delivery Center

Flattening comes bundled into Delivery Center Plus at $399 a month. As an SPF purchase that's poor value. As a deliverability and DNS monitoring suite that happens to include flattening, it's a different conversation, and most people evaluating MxToolbox are already having that one.

Three others belong on the shortlist. Red Sift Dynamic SPF and Valimail Instant SPF are both solid dynamic solutions sold inside platforms priced for mid-market and enterprise rather than as standalone SPF tools. Sendmarc's SPF Optimization is available only to paying customers and the pricing needs a demo call. Our own Hosted SPF sits in the SMB group: auto-refreshed flattening that ships with DMARC reporting rather than next to it, with tiers on the pricing page.

SPF flattening vs SPF macros vs hosted SPF

Three terms, used interchangeably by people who should know better, describing three different mechanisms.

Flattening publishes resolved IPs in your own record. Zero lookups, full transparency, and a staleness clock that starts the second you hit save.

Hosted SPF points your record at a vendor's domain that they keep current for you. One lookup, no staleness, and your authentication now rides on their DNS staying up.

Macros are the one worth understanding properly. Section 7 of RFC 7208 lets a managed service answer each query individually, returning a response tailored to the mail server asking, which sidesteps the lookup limit rather than working around it. The record ends up looking like this:

v=spf1 include:%{d}._spf.example-vendor.com ~all

Because resolution happens at query time, nothing goes stale. And your published record stops listing every IP address you send from, which is the benefit nobody mentions. A flattened record hands anyone with dig and thirty seconds a complete inventory of your SaaS stack. The spec language is in RFC 7208 section 7.

The catch is real, though. Your macro provider now sits in the path of every authentication check anyone runs against your domain. Read the SLA before the marketing page.

What SPF flattening costs across multiple domains

Nearly all of this pricing is quoted for a single domain. If you run client domains, do your own arithmetic before you get attached to a headline number.

Forty domains, for example. Fraudmarc's flat $21 per domain comes to $840 a month, a bit over $10,000 a year, for SPF and nothing else. AutoSPF's published tiers stop at ten domains for $387, with additional domains at $10 to $20, so forty lands somewhere between $687 and $987 depending on what you negotiate. That's arithmetic off their published tiers rather than a quoted price. Neither figure includes DMARC reporting.

Our honest advice to MSPs is to stop evaluating SPF tools on their own. What matters is SPF plus reporting plus a console that doesn't make you log into forty dashboards, and a bundled platform at $6 to $10 per domain usually beats a specialist at $21 once you add those up. The exception is genuine macro-scale requirements on specific clients, where the specialists earn their money.

Two things to settle before signing anything. Who holds DNS control for each client, you or them? And if you change vendors in eighteen months, what does that migration actually look like across forty records?

Before you buy, try the free fixes

A lot of over-limit records don't need a subscription. They need twenty minutes and someone willing to read them properly.

• Delete the dead includes. Most bloated records carry a marketing platform nobody has logged into since 2023, and every stale include costs you a lookup and a risk.
• Move bulk mail to a subdomain. Each subdomain gets its own 10-lookup budget and it costs nothing. Putting your ESP on mail.yourdomain.com frees the parent record straight away, at the price of another zone to look after. Flattening vendors will tell you that price is steep. They would.
• Swap a and mx mechanisms for explicit ip4: entries. Both cost a lookup and usually resolve to an address you already know by heart.
• Check whether DKIM alone can carry your DMARC alignment. If your main senders sign and align, a PermError hurts less than it looks. Still fix it. Just don't panic about it on a Friday.
• Read the sender's own documentation first. Google's SPF guidance gives the correct include for Workspace, and getting that one right frequently recovers two or three lookups on its own.

Still over ten after all that? Then the problem is structural and a tool is the right answer.

Frequently asked questions

What is the best SPF flattening tool?

For SMBs that also want DMARC reporting, PowerDMARC's PowerSPF is the cheapest credible entry at $8 a month, and bundled options like SimpleDMARC's Hosted SPF cover the same ground without a second subscription. For macro-grade scale or IP obfuscation, AutoSPF and Fraudmarc UniversalSPF are the specialists. MxToolbox only makes sense if you want its wider deliverability suite.

Is SPF flattening safe?

Flattening is safe. Stale flattening isn't. The moment a provider rotates its IP ranges, a static flattened record starts rejecting your own mail, so use a service that re-resolves continuously and never hand-flatten a record you'll forget about.

What's the difference between SPF flattening and SPF macros?

Flattening resolves your includes into static IP addresses published in your own DNS record. Macros hand resolution to a managed service that answers every query individually, avoiding the 10-lookup limit without publishing your IPs. Flattening is simpler and self-contained. Macros scale further but depend on a live third-party service.

Can I flatten my SPF record manually?

You can, and it'll work for a few weeks. Google and Microsoft change their published IP ranges several times a year and a manual record won't follow them. If you do flatten by hand, put a monthly re-check in the calendar, because the failure is silent.

Do MSPs need a dedicated SPF flattening tool?

Usually not. Specialist per-domain pricing around $21 gets expensive quickly across a client base, and you're still buying DMARC reporting separately. A multi-tenant platform with hosted SPF included is generally better value until you hit genuine macro-scale requirements.

Does SPF flattening affect DMARC?

Yes, and it matters more than people expect. DMARC needs SPF or DKIM to pass and align with the From domain, so a record returning PermError fails SPF for every message and leaves DKIM holding your policy up alone. Fixing the lookup limit gives you back one of your two authentication paths.

Pick the mechanism first, then the vendor

Choose between flattening, hosted SPF, and macros based on how many senders you have and how much third-party dependency you can live with. Compare price after that, and compare it per domain rather than per headline.

Start by checking your record with our free SPF record checker. If you're over ten lookups, SimpleDMARC's Hosted SPF keeps it current automatically and comes with DMARC reporting included, so it's one subscription rather than two.