Limitations & risks of SPF flattening

Flattening trades a live lookup for a cached snapshot of IPs. That's safe when done carefully, but there are real trade‑offs:

Snapshot lag. If a provider adds IPs between refreshes, mail from the new IPs could softfail until our next refresh (max 15 minutes).
Dynamic mechanisms. exists: and ptr depend on the sending client and cannot be flattened. We preserve them and warn you.
Large IP sets. Some providers expand to hundreds of ranges. We warn you and may recommend keeping them as an include.
Policy meaning. We never widen your policy: only pass‑qualified mechanisms are flattened, and your final all qualifier is preserved exactly.

Our defaults prioritize correctness and safety over aggressive minimization.