--- title: "SPF Management (AutoSPF): Automatic SPF Flattening Under the 10-Lookup Limit | DuoCircle" description: "AutoSPF flattens your SPF record automatically and keeps it under the 10-DNS-lookup limit, even as you add senders and your senders change their includes. The first net-new product DuoCircle built after our 2014 founding, now running for organizations up to a $16 billion IT services firm." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/email/spf-management/" --- Automatic SPF flattening · Under the 10-lookup limit · Built 2014 # SPF Management. Flat record, full coverage. Someone on your team finally pasted your SPF record into a checker and saw the result: the 10-DNS-lookup limit blown, authentication quietly degrading, and a list of senders nobody can prune. AutoSPF flattens every included sender into a single hosted record, watches the upstream for changes, and keeps your SPF posture intact. [ Talk to an Expert → ](/contact/) [ Visit autospf.com ](https://autospf.com/?utm%5Fsource=duocircle&utm%5Fmedium=capability&utm%5Fcampaign=cross%5Fsell) AutoSPF · widgets.com Lookups 3 of 10 limit Senders 14 flattened Refreshed 12m ago your published SPF 1 lookup → us v=spf1 include:\_spf.duocircle.com \-all flattened from 14 vendors · spf.protection.outlook.com · \_spf.google.com · mailgun.org · sendgrid.net · spf.mandrillapp.com · servers.mcsv.net · spf.zoho.com \+ 7 more monitoring 14 upstream sources healthy The story behind it ## DuoCircle's first net-new product, built because the math didn't work AutoSPF was the first product DuoCircle built from scratch after our 2014 founding. The story is short. A customer paying us about $4 a month for forwarding came back with a question: their SPF record had blown the 10-DNS-lookup limit, authentication was failing, and they needed someone to flatten and maintain it for them. The only specialist providing that service at the time wanted roughly $1,000 a month to take the work on. The math, on a $4-a-month customer, did not pencil out. So we wrote the flattening engine ourselves, hosted the record, monitored the upstream senders, and charged a price that matched the actual cost of running the service. AutoSPF now runs for organizations up to and including a $16 billion IT services firm, on the same engine, on the same volume-based pricing model. The customer who originally asked for it is still on the platform. What it does ## The mechanics, plainly You point your domain's SPF record at AutoSPF once. From there, the service does four things continuously. 01 ### Automatic SPF flattening Every included sender resolved and flattened into a single SPF record we host on your behalf. Your published record stays well under the 10-DNS-lookup limit no matter how many ESPs, marketing tools, transactional providers, and helpdesks you add. 02 ### Continuous upstream monitoring Senders change their SPF includes constantly. Google Workspace adds a netblock, a marketing platform rotates infrastructure, a payroll vendor adjusts its outbound IPs. AutoSPF re-resolves your includes daily, picks up the change, and updates your hosted record before authentication breaks. 03 ### Change alerts and webhooks When an upstream sender changes its IPs, you find out. Email notifications and webhook deliveries surface the diff so your team has a record of what changed and when. No silent reshuffling of your authentication posture. 04 ### Volume-based pricing You pay for the senders you actually flatten. SMB starts cheap, enterprise scales without re-negotiating, and there are no per-feature add-ons buried behind a sales call. The pricing is on the product site. Who this is for ## The audience - IT teams whose SPF record has crept past the 10-DNS-lookup limit and are now seeing intermittent SPF PermError on outbound mail - Organizations that send through five or more sources (Microsoft 365 or Google Workspace plus marketing automation, transactional, helpdesk, payroll, and a CRM) - Operations teams who don't want to re-flatten the SPF record by hand every time a vendor changes its includes - MSPs and consultants managing SPF for portfolios of client domains who need a single place to maintain authentication posture - Procurement teams comparing AutoSPF against the high-priced incumbents and looking for capability without a five-figure annual commitment When to look elsewhere ## We're not the right answer if **You only send from a single source.** If your SPF record contains one Microsoft 365 or Google Workspace include and nothing else, you are nowhere near the 10-DNS-lookup limit. Flattening adds operational dependency you don't yet need. Come back when you've added a few more senders. **You need full DMARC enforcement and reporting today.** SPF flattening fixes the lookup-limit half of the authentication picture. The reporting and enforcement half lives in [DMARC Report](/email/dmarc/). Many customers run both, but they solve different parts of the problem. **You're shopping the high-end incumbents.** If the procurement requirement is a specific brand on the invoice, AutoSPF is not that brand. We do publish a side-by-side at [Valimail alternatives](/resources/valimail-alternatives/) so you can decide on the technical merits rather than the vendor logo. What you get when you call ## A real expert, same day When you reach out about AutoSPF, the person on the call is the person who will actually look at your SPF record. We pull it up, count the lookups, identify which includes are inflating the count, and tell you whether AutoSPF is the right fix. Sometimes the answer is yes. Sometimes the answer is "you have three vendor includes you stopped using two years ago, prune those first." Both answers are free. If AutoSPF is a fit, the rollout is short. You publish the new SPF record pointing at AutoSPF, we resolve and flatten your includes, and the service starts monitoring the upstream the same day. The next time Google Workspace updates its SPF includes, you don't notice, because nothing breaks. AutoSPF is part of the broader [Authenticate group](/products/authenticate/). Most customers who fix their SPF record with us end up with [DMARC Report](/email/dmarc/) shortly after, because the next question after "is my SPF clean" is "who is actually sending mail as my domain right now." ## Talk to an expert about your SPF record Same-day response. Real expert on the call. We tell you whether AutoSPF is the right fix and, if it isn't, what is. [Talk to an Expert→](/contact/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"Product","name":"AutoSPF (DuoCircle SPF Management)","description":"Automatic SPF flattening and continuous monitoring that keeps your published SPF record under the 10-DNS-lookup limit, regardless of how many third-party senders you add.","brand":{"@type":"Brand","name":"DuoCircle"},"url":"https://www.duocircle.com/email/spf-management/","category":"Email Authentication Software"},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"DuoCircle","item":"https://www.duocircle.com"},{"@type":"ListItem","position":2,"name":"Authenticate","item":"https://www.duocircle.com/products/authenticate/"},{"@type":"ListItem","position":3,"name":"SPF Management","item":"https://www.duocircle.com/email/spf-management/"}]}] ```