One SPF record, tightened and inside the limit.
Two separate limits sit inside every SPF record, and crossing either fails the whole record rather than weakening it. Managed SPF is two jobs: hardening the record, then flattening it if hardening is not enough.
A record that fails without telling you.
SPF stands for Sender Policy Framework. It is one line published in your domain settings listing which servers are allowed to send email using your name, and most of that line is not addresses but pointers at other companies: your mail provider, your marketing tool, your ticketing system, your payroll software. Following each pointer costs the receiving mail system a lookup.
There are two ways that breaks, and neither announces itself. A pointer that resolves to nothing, because the domain behind it was retired or holds no records any more, still spends one of your ten lookups, and only two of those dead ones are allowed before the third turns the whole record into a permanent error. Separately, the ten itself is a hard ceiling, and the eleventh lookup fails the record outright. Nothing warns you either way. The line still reads correctly where you published it, while mail that depended on it is refused or filed as spam.
Counted, hardened, then flattened if it needs it.
Shorter is not the same as stricter.
Managed SPF covers two jobs, and most records need one of them rather than both. Hardening is about what the record should not contain: lookups that resolve to nothing, and permissions nobody uses. Flattening is about how many places it points at. Hardening comes first, because plenty of records come back inside the limit on deletions alone.
Removing what should not be there
This is the honest first move, and it is often the whole job. Void lookups are entries pointing at a name that resolves to nothing, usually a provider you left, a domain that was retired, or a name somebody mistyped, and each one still spends a lookup: two are allowed before the third fails the record outright. Unused senders are the entries still authorising tools you stopped sending from, along with the broad ones that quietly authorise a whole shared platform to send as you. Every one of those is a wasted lookup and a standing permission somebody else could use. Once every genuine sender is accounted for, the catch-all at the end moves from soft fail to hard fail, so anything not on the list is refused rather than merely doubted.
When hardening is not enough
This is the fix for a record that still points at too many places once the dead and unused entries are gone. Ten DNS lookups is the ceiling, and the eleventh does not degrade the record, it fails the whole thing as a permanent error, which receiving systems treat much the same as publishing nothing at all. Flattening resolves the pointers down to the addresses behind them, so the count stops being the constraint, and it trades those lookups for length, which is why the result is checked against the DNS size limits too. It is a snapshot rather than a permanent answer: the companies you send through renumber without telling anyone, so you point your SPF at ours once and every re-check and republish after that is ours to make.
One record, done properly.
A one-off job, then kept in step with the providers behind it for as long as we run your records.
See your own count first.
The SPF tree viewer expands your record and counts it against the ten-lookup limit, which tells you straight away whether flattening is even in question. It reads public domain records only, so nothing is changed and nothing is published.
The record is one part of the email side.
The service that runs your records day to day, the reports that name every sender the record has to cover, and the logo work that only starts once blocking is stable.
Email authentication
SPF and DMARC set up and managed, with DMARC set to block and monitored, so mail faking your exact address is refused rather than delivered. Every sender checked for a valid signature, and your verified logo in inboxes once blocking is stable.
Learn more →DMARC reports
The daily DMARC reports collected and read for you: every service sending as your domain named, with volumes, what passed, and a written review every month. The list that makes blocking safe to switch on.
Learn more →BIMI certification
Your verified logo beside your mail in the inboxes that support it, including the Verified Mark Certificate it depends on. The last step once DMARC is set to block.
Learn more →