Does SPF Flattening Require Access to Your DNS Account?

SPF flattening can work without DNS account access. Emailmetry uses a record you add at your existing provider, with no mailbox access or mail relay.

Your DNS stays with your provider

You make the DNS change yourself, or ask whoever already manages it for you. With Emailmetry's setup, the supplied record points SPF checks to a flattened record hosted by Emailmetry. Emailmetry does not need your DNS password or API key, and your email continues through your existing providers.

Flattening resolves supported SPF references into IP address ranges. Receivers can check those addresses without following each original provider reference, reducing SPF lookups. Automatic refreshes keep the flattened list current as those providers change their sending addresses.

Emailmetry can update its hosted record without editing the record in your DNS account. That is how the address list can change while your DNS login stays with you.

Who controls which record?

Changing the hosted address list does not require the service to sign in to your DNS account. Removing its include from your SPF record stops that reference from authorising senders through it. A replacement policy must still cover your intended sending services.

What you trust the flattening provider to do

An ordinary SPF include lets a referenced policy authorise sending IP addresses, as described in the SPF standard. A hosted flattened record uses that same mechanism. Including it means trusting the provider to publish the right addresses for the services you have selected.

If the provider adds the wrong address, it could authorise a sender you did not intend. If it leaves out a legitimate address, that sender may no longer pass SPF. This makes accurate flattening and updates important even though the provider cannot edit your DNS account.

The SPF include gives no permission to change your website records, redirect incoming mail or open a mailbox. You retain control of the SPF record that points to the service and can replace it if you choose another arrangement.

Extra permissions are a separate choice

A DNS API token lets software edit records directly. Its permissions determine the reach of that access. For example, Cloudflare tokens can be restricted by permission and domain, but DNS write access can cover more than an SPF record.

Changing nameservers is broader again: it moves responsibility for publishing your domain's DNS records to another provider. Cloudflare's full setup documentation describes that change. A hosted SPF include requires neither arrangement.

Emailmetry's safeguards and supported-policy limits describe the flattening service behind its hosted record. The DNS change you make connects your domain to that service; it does not hand over the rest of your domain or email account.