CertaSPF (SPF Flattening)

Included with Email Authentication Premium and above, or as the Hosted SPF add-on ($10/month or $110/year) on Free and Plus.

To count a domain's SPF lookups without an account, use the free SPF Inspector.

1. What This Feature Does

Receivers stop after 10 DNS lookups when checking an SPF record, and every include: costs at least one. Past the limit, SPF fails for all of your mail, including mail from services you did authorise.

CertaSPF keeps your SPF record inside that limit, built from a list of the services and servers allowed to send as your domain. It works in one of two modes:

• Static Flattening — every sender's addresses are written into the record as ip4: and ip6: entries. No lookups, but the record grows with each sender, and it goes stale when a provider changes its addresses.
• Dynamic SPF — your record is a single include: that CertaDNS answers at the moment a receiver checks it, against your current sender list. The record stays at three lookups however many senders you add, and never needs editing when a sender changes.

The same screen has two quick tools: an SPF Lookup Tool that counts any domain's lookups, and an SPF Flattener that produces a one-off flattened copy of any record.

2. When You Should Use It

• Your SPF record is at or over 10 lookups, or close to it, and you keep adding sending services.
• You want to add or remove a sending service without editing DNS each time (Dynamic SPF).
• Your SPF record authorises services you no longer use and you want one list of who may send as your domain.

3. When You Should Not Use It

• Your record is comfortably under 10 lookups and rarely changes. A hand-written record is simpler.
• The domain never sends mail. Publish v=spf1 -all yourself, and a strict DMARC policy with the DMARC Policy Wizard.
• The domain is parked. Parked domains cover DMARC and DKIM only. Turn the domain on in Email Authentication > Manage Domains first; this uses a domain slot from your tier.

4. Prerequisites

• Email Authentication Premium or above, or the Hosted SPF add-on on Free or Plus. Without either, the CertaSPF view shows an upgrade panel instead of the tools.
• The domain added under Email Authentication > Add Domains and active (not parked). Managed DNS is not required.
• Access to edit the TXT record at your domain's apex, where your DNS is hosted.
• A list of every service and server that sends mail as your domain. DMARC Reporting shows which ones actually do.

5. How It Works (Brief)

You publish the record. An SPF record is a TXT at the apex of your domain, and an apex cannot be a CNAME, so this is the one email-authentication record CertaDNS cannot host behind a CNAME. CertaSPF builds the record and you place it at your DNS host, replacing your existing SPF record. A domain must have exactly one. If the domain uses Managed DNS, CertaDNS publishes the record in your zone for you and keeps it current; your other records at the apex are kept.

The sender list decides. The record is built from the Authorized senders on the configuration: services picked from the provider catalogue, include: host names, and IP addresses or ranges. Anything not on that list is not authorised.

Static Flattening. Each sender is resolved to its addresses and the record lists them all, followed by your policy (for example ~all). CertaDNS re-resolves the senders regularly and updates the record shown in the dashboard. Because you published a copy, a change here only reaches receivers when you update your TXT record.

Dynamic SPF. The record you publish is:

v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.certadns.com ~all

(with your chosen policy at the end). The receiving server fills in the sending IP, the sending server's name and your domain, and asks CertaDNS. The answer is a pass if the IP is in one of your senders' address ranges, or if the sending server belongs to a provider you authorised from the catalogue; otherwise it is a fail. The _spf.certadns.com name belongs to CertaDNS — you do not create anything called _spf in your own zone. Changes to the sender list take effect within about five minutes.

6. How to Use It

Everything below is in Email Authentication > Hosted Services > CertaSPF.

Check a domain's SPF record

1. In SPF Lookup Tool, enter a domain and click Check SPF.
2. The result shows the record, its DNS Lookups count (flagged over 10) and its length in Characters.

Flatten a record once

1. In SPF Flattener, choose Enter Domain or Paste SPF Record, then click Flatten SPF Record.
2. Copy the Flattened SPF Record. This is a one-off copy: nothing keeps it up to date. For a record that stays current, set up a configuration below.

Set up CertaSPF for a domain

1. In Managed SPF Configurations, click Set Up SPF (or Add a domain once you have one). If a domain already publishes an SPF record, it is listed under Published, not managed here; click Manage this to start from it.
2. Choose the Domain, the SPF Mode (Static Flattening or Dynamic SPF) and the SPF Policy.
3. Optionally paste your Current SPF Record. On a Managed DNS domain the dashboard fills it in when it finds one.
4. Click Create Static SPF Config or Create Dynamic SPF Config.
5. Click the new configuration to open it, and add every sender under Authorized senders (below). Do this before you publish: the record is rebuilt from this list, and a record you pasted in step 3 is not turned into senders.
6. Copy the record shown — "Set this as your TXT record" for Dynamic SPF, "Flattened SPF record" for Static — and publish it as the TXT at your domain's apex, replacing your old SPF record. On a Managed DNS domain the panel says "Published for you" instead, and there is nothing to copy.

Add or remove a sender

In the open configuration, under Authorized senders, choose a tab:

• ESP — search the provider catalogue (type at least two characters), pick the provider, and click Add sender. A provider with several SPF includes is added as one entry.
• include: — enter the host name a service gave you, for example spf.example.com, with an optional label.
• IP / CIDR — an IPv4 or IPv6 address or range, for example 198.51.100.0/24, with an optional label.

Click the × on a sender to remove it. The record is rebuilt straight away. With Static Flattening, update your published TXT record afterwards.

Other actions on a configuration

• Regenerate — rebuilds the record from the current sender list.
• Copy — copies the record to publish.
• Switch to Dynamic / Switch to Static — changes mode after a confirmation. The record to publish changes, so replace your TXT record afterwards. Resolvers may keep the old record until its TTL expires.
• Stop managing — deletes the configuration after a confirmation. On a Managed DNS domain the SPF record is removed from your zone. Elsewhere, the record you published stays; if it is a Dynamic SPF record, replace it first, because its CertaDNS include stops answering.

Check that the record is published

For a domain whose DNS is hosted elsewhere, open Email Authentication > Manage Domains and click the pencil on the domain. The SPF record entry shows Live when your published record matches (for Dynamic SPF, when it contains the CertaDNS include), and Not found otherwise, with the reason. Click Check again after a change.

7. Inputs and Settings

8. Outputs and Results

Each configuration shows

• The domain, the number of senders and the policy.
• A badge: Dynamic; Optimized for a static record within the limit; or the lookup count in red when the record you started from was over 10.
• When open: the mode, the record to publish, and — for Dynamic SPF — how many addresses and senders it covers.

The SPF Flattener shows

• The flattened record, the original lookup count, and the number of IPv4 and IPv6 addresses.
• Resolved Includes, and any Warnings or Errors.

9. How to Interpret Results

Normal

• A Dynamic SPF configuration with every sending service listed, and the domain's SPF record entry Live in Manage Domains.
• A static record containing many address ranges. Large providers publish dozens.

Worth investigating

• "No senders authorized yet." With Dynamic SPF and no senders, every message fails SPF. Add your senders before publishing.
• A static record that differs from the one you published. A provider changed its addresses. Publish the new record, or switch to Dynamic SPF so this stops happening.
• SPF failures in DMARC Reporting from a service you use. It is missing from the sender list.

Common mistakes

• Publishing a second SPF record instead of replacing the first. Two SPF records make every check fail.
• Expecting the pasted record to become the sender list. It does not; add each sender.
• Reading an SPF pass as a DMARC pass. DMARC also needs the envelope domain to align with your From: address. Reporting > SPF Analysis shows alignment.

10. Common Issues and Explanations

"Hosted SPF is included with Premium. It is also available as a $10/month add-on on Free and Plus."

Your tier does not include CertaSPF. Upgrade to Premium, or add Hosted SPF.

"CertaSPF needs … to be an active domain. …"

The domain is parked. Turn it on in Email Authentication > Manage Domains.

"SPF configuration already exists for this zone"

The domain already has a configuration. Open it in the list instead.

"No SPF record found for …"

From the flattener: the domain publishes no SPF record. Paste a record instead.

"Circular reference detected" or "Max recursion depth reached"

The record's includes loop back on themselves, or nest more than 10 deep. Fix the record at its source.

"PTR mechanism is deprecated and may cause issues"

The record uses ptr. It cannot be flattened and receivers may ignore it; authorise those servers by address instead.

"SPF record is … characters. May need to be split across multiple TXT records."

A flattened record over 450 characters. Some DNS hosts need a long TXT value entered as several quoted strings. Dynamic SPF avoids this.

"Large number of IPs (…). Consider using Dynamic SPF for better performance."

The flattened record lists more than 500 addresses. Dynamic SPF keeps the record short.

"Provider has no SPF includes configured"

That catalogue entry cannot be added as an ESP. Add the provider's include host name on the include: tab instead.

11. Limits and Constraints

12. Related Features

• DMARC Reporting — which services send as your domain, and whether they pass SPF.
• Hosted DKIM — the other half of DMARC alignment.
• DMARC Policy Wizard — moving to enforcement once SPF and DKIM pass.
• SPF Inspector — free lookup and void-lookup counts for any domain.

13. Updates and Behavior Changes

• 30 September 2026. Article rewritten to match the product: CertaSPF is under Hosted Services; senders are added as ESP, include or IP / CIDR; you publish the record yourself, and the _spf name used by Dynamic SPF belongs to CertaDNS, not your zone. Earlier versions described settings, sender types and automatic publishing the dashboard does not offer.
• 1 October 2026. On a Managed DNS domain CertaDNS now publishes the SPF record for you, keeping the other records at your apex. A configuration can be deleted with Stop managing.