Two SPF records? How to merge them into one
A domain can publish only one SPF record. If yours has two TXT records that start with v=spf1, receivers treat SPF as a permanent error, which is as good as having none. The fix is to merge every sender into a single record and delete the extra one.
The free SPF checker shows whether your domain has two records, along with the other mistakes that break SPF.
Why does a domain end up with two SPF records
It almost always happens when you add a new sender. A platform’s setup guide says “add this SPF record”, and someone adds a second record instead of adding the platform to the existing one. It also happens during migrations, when the old platform’s record never gets removed.
The SPF standard, RFC 7208, is clear: more than one SPF record is an error, and receivers that follow it stop checking.
How do you merge two SPF records
Say your domain has these two records:
v=spf1 include:_spf.google.com ~all
v=spf1 include:mail.example-platform.com -all
Merged, they become one:
v=spf1 include:_spf.google.com include:mail.example-platform.com ~all
- List every sender. Your newsletter platform, Google Workspace or Microsoft 365, your CRM, your ticketing tool, anything that sends as your domain.
- Put every
include:,ip4:andip6:into one record, starting withv=spf1. - End with one ending. Pick
~allor-all, not both. - Delete the old records, so only the merged one is left.
- Check again once DNS updates, usually within minutes to a few hours.
What is the SPF 10-lookup limit
Each include:, a, mx, exists and redirect makes receivers run a DNS lookup, and includes inside includes count too. RFC 7208 caps it at 10. Go over and SPF fails with a permanent error, even though the record looks fine.
Merging two records can push you over. If it does, remove senders you no longer use first. Our checker doesn’t count lookups yet, so count them by hand: every include you add, plus any includes inside it.
Which SPF ending should you use
| Ending | Name | What it tells receivers | Use it? |
|---|---|---|---|
-all |
Fail | Reject mail from servers not listed. | Yes, once you’re sure every sender is listed. |
~all |
Soft fail | Accept it, but treat it as suspicious. | Yes. The common choice. |
?all |
Neutral | Say nothing either way. | No. It vouches for nobody. |
+all |
Pass | Anyone can send as you. | Never. |
Quick checklist
- Exactly one record starting with
v=spf1 - Every service that sends as your domain is in it
- 10 DNS lookups or fewer, counting nested includes
- Ends with
~allor-all - The old, unmerged record is gone
More on what SPF does for a newsletter: SPF records for newsletters. SPF is half of what DMARC checks, so see what is DMARC too.