---
title: "The One Big Drawback of Using SaaS Providers and What to do About it | DuoCircle"
description: "We live in a software-as-a-service (SaaS) world."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/"
---

Quick Answer

SaaS vendors that send mail on your behalf (CRM, marketing platform, payroll, ticketing, ESP) each add their SPF include to your record. Because SPF caps DNS lookups at 10 per evaluation, three or four SaaS providers can put you over the limit, returning permerror and breaking authentication. Worse, SPF has no error reporting, so you find out when legitimate mail goes to spam. Manual SPF flattening (replacing includes with the underlying IP ranges) reduces lookups but breaks every time a vendor updates its sending IPs, which they don't proactively communicate. Automated flattening services like AutoSPF point your SPF record at a managed endpoint, query each vendor's record on a short cycle (every few minutes), and serve a flat ip4 and ip6 list back to receivers. The record stays under 10 lookups and stays current without manual maintenance.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=The%20One%20Big%20Drawback%20of%20Using%20SaaS%20Providers%20and%20What%20to%20do%20About%20it&url=undefined%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F&title=The%20One%20Big%20Drawback%20of%20Using%20SaaS%20Providers%20and%20What%20to%20do%20About%20it "Share on Reddit") [ ](mailto:?subject=The%20One%20Big%20Drawback%20of%20Using%20SaaS%20Providers%20and%20What%20to%20do%20About%20it&body=Check out this article: undefined%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F "Share via Email") 

![Using SaaS Providers](https://media.mailhop.org/duocircle/images/2019/04/sender-policy-framework-6913.jpg) 

_We live in a [software-as-a-service](https://en.wikipedia.org/wiki/Software%5Fas%5Fa%5Fservice) (SaaS) world._ It’s great being able to pay a monthly fee and have some other companies handle your organization’s services for you. There are all kinds of companies that provide SaaS services.

There are companies that take care of

- customer service (e.g., Zendesk),
- marketing campaigns (e.g., SendGrid)
- customer relationship management (e.g., Salesforce)
- company benefits (e.g., Zenefits) and
- even payroll (e.g., Workday).

And the one thing all these service providers have in common is they send out emails to your customers and employees on your behalf. Generally speaking, that’s a good thing, but it does come with a big drawback most people aren’t even aware of. If you’re planning to enter this space, it’s essential to carefully plan how you will [develop your SaaS](https://binary-studio.com/saas-application-development/) to ensure scalability, security, and a seamless user experience.

[![sender policy framework](https://media.mailhop.org/duocircle/images/2019/04/spf-record-tester-1287.jpg)](https://media.mailhop.org/duocircle/images/2019/04/spf-record-tester-1287.jpg)

To **prevent email spoofing**, your company will want to use an email authentication technique called [Sender Policy Framework](https://en.wikipedia.org/wiki/Sender%5FPolicy%5FFramework) or SPF. This protects your customers and employees by ensuring they only receive emails from service providers you approve.

Now, you don’t typically know the IP addresses of the email servers your service providers use to send out emails, and they often use more than one. But, you do know their domains (e.g., sendgrid.com, salesforce.com) and so that’s what you’ll put in your SPF record to protect your customers and employees. You only want them receiving emails from those companies’ domains. And that’s where the trouble begins.

> SPF authentication only deals with IP addresses, not domains.

So, when you enter the domain of one of your service providers, you’re forcing the SPF authentication process to look up those IP addresses in the [domain name system](https://en.wikipedia.org/wiki/Domain%5FName%5FSystem) (DNS). But, the _DNS has a strict limit of 10 lookups and that’s a problem_.

Once the DNS lookup limit is reached, the process will no longer convert domains to IP addresses. That means either your customers/employees are getting unauthenticated emails, or worse, not getting them at all. And what makes it even worse is you’ll never know about it because SPF has no error handling capability.

[![email security](https://media.mailhop.org/duocircle/images/2019/04/spf-validator-1230-1.jpg)](https://media.mailhop.org/duocircle/images/2019/04/spf-validator-1230-1.jpg)

One of the ways you could try to address the problem is by figuring out all of your service providers’ IP addresses and putting them in the SPF record instead of the domains to reduce the number of DNS lookups to less than ten. _This technique is called “SPF flattening.”_ The problem with this approach is that the IP addresses used by your service providers to send out email changes all the time, and they’re not going to go out of their way to let you know about it.

To do it right, _manually flattening your SPF record requires that you constantly monitor your service providers for changes in their IP addresses_. What you need is a way to do that automatically, hands-off, with no intervention from you. And that’s where [AutoSPF](https://autospf.com/) comes in.

With AutoSPF you just point your SPF record to the AutoSPF server and AutoSPF takes care of the rest. AutoSPF always returns a flattened SPF record to public DNS queries. It checks for changes in IP addresses of your service providers every couple of minutes so you don’t have to.

Adding SPF flattening with AutoSPF is fast, easy and affordable. There are no sales calls, no contracts and you’re up and running in ten minutes. And AutoSPF works with all 3rd party email service providers. It will improve your [email security services](/advanced-threat-defense). What are you waiting for? Try [AutoSPF](https://autospf.com/) risk-free for 30 days. Your customers and your employees will be glad you did.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F) [ ](https://twitter.com/intent/tweet?text=The%20One%20Big%20Drawback%20of%20Using%20SaaS%20Providers%20and%20What%20to%20do%20About%20it&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthe-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it%2F) Copy 

Related Articles

- [  BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does Email Security ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/)
- [ ![Designing A Custom Dkim Architecture For High-Volume Email Senders](https://media.mailhop.org/duocircle/images/2026/04/buy-smtp-1290.jpg)  Designing A Custom Dkim Architecture For High-Volume Email Senders Email Security ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/)
- [ ![DMARC, SPF, and DKIM](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4526.jpg)  DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Email Security ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)
- [ ![Email Monitoring Tools](https://media.mailhop.org/duocircle/images/2026/05/spf-validator-6720.jpg)  Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem Email Security ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/)

## Related Articles

[  Email Security 8m  BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does  May 5, 2026 ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/)[  Email Security 8m  Designing A Custom Dkim Architecture For High-Volume Email Senders  Apr 28, 2026 ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/)[  Email Security 12m  DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice  Apr 29, 2026 ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)[  Email Security 5m  Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem  May 7, 2026 ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"The One Big Drawback of Using SaaS Providers and What to do About it","description":"We live in a software-as-a-service (SaaS) world.","url":"https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/","datePublished":"2019-04-16T18:14:36.000Z","dateModified":"2025-04-09T14:18:27.000Z","dateCreated":"2019-04-16T18:14:36.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/"},"articleSection":"email-security","keywords":"","wordCount":594,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/04/sender-policy-framework-6913.jpg","caption":"Using SaaS Providers","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"The One Big Drawback of Using SaaS Providers and What to do About it","item":"https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"The One Big Drawback of Using SaaS Providers and What to do About it","item":"https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"The One Big Drawback of Using SaaS Providers and What to do About it","description":"We live in a software-as-a-service (SaaS) world.","url":"https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/","datePublished":"2019-04-16T18:14:36.000Z","dateModified":"2025-04-09T14:18:27.000Z","dateCreated":"2019-04-16T18:14:36.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/the-one-big-drawback-of-using-saas-providers-and-what-to-do-about-it/"},"articleSection":"email-security","keywords":"","wordCount":594,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/04/sender-policy-framework-6913.jpg","caption":"Using SaaS Providers","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```