Need Guidance on SPF Flattening for Zoho Mail Configuration

Need Guidance on SPF Flattening for Zoho Mail Configuration

Hi everyone,

I'm hoping to get some advice on optimizing my SPF record for a Zoho Mail setup. I use Zoho Mail along with several other Zoho services, and as a result, my current SPF record has grown to include multiple include mechanisms. My Cloudflare record looks like this:

v=spf1 include:zcsend.net include:transmail.net include:zoho.com include:zohomail.com include:one.zoho.com ~all

When I run this SPF record through various online validation tools, I'm consistently flagged for a couple of critical issues:

  1. Excessive DNS Lookups: The record results in 11 DNS lookups, which is over the permitted limit of 10. I understand this can cause some receiving mail servers to fail the SPF check outright, potentially leading to delivery problems.
  2. Duplicate IP Mechanisms: The validator reports several warnings about duplicate IP addresses, with errors like: "Duplicate ip4 mechanism. The value 'ip4:136.143.188.0/24' is invalid." It seems the IP ranges from the different Zoho include statements overlap.

The recommendation from these tools is to perform SPF Flattening. I understand the basic concept—to consolidate all the IP addresses from the various include statements into a single, flat list of ip4 and ip6 ranges to reduce the lookup count and clean up the duplicates.

However, I want to make sure I implement this correctly for Zoho's ecosystem. My main questions are:

  • What is the most reliable way to gather all of the current IP ranges that Zoho uses for email sending, considering all these different services (zcsend.net, transmail.net, etc.)?
  • Is there a recommended tool or process for generating an accurate flattened record that won't break my email delivery?
  • Once flattened, I'm concerned about maintenance. If Zoho adds new IP addresses in the future, my flattened record will become outdated. What is the best practice for handling these updates? Should I manually re-check and update the record periodically, or are there better solutions?

I would greatly appreciate any detailed steps, personal experiences, or best practices you can share. Thank you in advance for your help

    • Sticky Posts

    • Important update! Re-authentication mandated for sensitive admin operations in Admin Console.

      Dear Zoho Mail Community, Hope you're all doing good and staying safe! As we strive to provide you with better security for your business email needs, an additional measure has been taken to ensure more security to the sensitive Admin Operations performed

    • Important announcement: IPv6 support in Inbound gateway

      Greetings from Zoho Mail team. We are happy to announce the support of IPv6 support for receiving emails in Zoho Mail. This post mainly addresses the admins who have configured inbound gateway for their organisation. As a part of the changes related to

    • Administrators now have permissions to access the Subscription and Payment details.

      Hello everyone! Hope you are all staying safe during these trying times. To ensure that your organization's email service, the backbone of communication, does not get affected due to inadvertent negligence by the super administrator, we have made a few changes in our roles and permissions to handle subscription and renewal smoothly. Earlier, any organization's Subscription and Payment information in Zoho Mail could be accessed only by the organization's Super Administrator. Now, based on requests

    • Move ahead from Docs to WorkDrive - WorkDrive is now available in all Workplace plans!

      Dear all,  We are glad to announce that WorkDrive is available across all the Workplace plans, with added storage and extensive team features.  Zoho WorkDrive is now available for all users, including those who subscribed before Zoho WorkDrive was introduced

    • Announcement - Changes in Custom login page

      In continuation to our efforts in protecting your Zoho Mail account we have made a few changes in the custom login page. We are making some enhancements in the browser to server communication to make it more secure.  You may be aware of the most of the modern web browsers mandate certain security practices to showing the webpages as 'Secure'.  We are rolling out the security related enhancements ensure that our custom login page accessed only in https mode and the authentication is securely done

    Nederlandse Hulpbronnen