Autonomics AI Get a free audit
Menu

Two SPF records? Merge them into one

Two SPF records don't add up to more permission. They cancel each other out and SPF fails for everything. The fix takes five minutes.

Written by Sean Solano Paul, founder of AutonomicsAI LLP. Checked against provider documentation on .

A domain may publish exactly one TXT record starting with v=spf1. With two, RFC 7208 tells receivers to return permerror, so SPF fails for every message, including mail from services that are listed correctly in either record. It usually happens when a new tool's setup guide says "add this TXT record" and someone adds it instead of editing the one that's there.

How to merge them

  1. Copy both records somewhere safe.
  2. Keep one v=spf1 at the start.
  3. Put every include:, ip4: and ip6: term from both into the one record. Drop exact duplicates.
  4. End with a single ~all or -all. If the two endings differed, use ~all until your DMARC reports are clean.
  5. Edit one of the TXT records to hold the merged value, then delete the other.

Example

Before, two records:

v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net -all

After, one record:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Check after merging

  • Count lookups across the merged record. Two records that were each under 10 can be over 10 together. See getting under 10 lookups.
  • Other TXT records at the root, such as Google site verification or Microsoft MS= codes, are fine. Only records starting v=spf1 count.
  • An old DNS record type called "SPF" (type 99) is obsolete. If your DNS host still shows one, delete it and keep the TXT record.

Questions people ask

Can I have one SPF record per email service?

No. One per domain name. Each subdomain can have its own, but the root gets exactly one.

How long until the fix works?

As soon as caches expire, usually within an hour (the record's TTL). The checker shows what public DNS returns right now.

DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.