Multiple SPF records: why it breaks everything and how to merge them

A domain is allowed exactly one SPF record. Publish two — usually the result of a new tool's setup wizard saying "add this TXT record" and someone adding instead of editing — and receivers don't pick one or combine them: the standard says multiple records are a permanent error. Both records stop working, and mail that used to pass SPF starts failing.

Updated July 13, 2026

How this happens

Every email service's onboarding says the same thing: "add a TXT record starting with v=spf1." If your DNS already has one, the correct move is to merge the new mechanism into it — but nothing stops you from adding a second record, and most DNS dashboards won't warn you. It sits there silently breaking SPF for every sender you have.

How to check

Run your domain through our SPF checker — it flags multiple records explicitly. Or query it yourself: dig txt yourdomain.com and count the answers that start with v=spf1. More than one is the bug.

How to merge correctly

Take every mechanism from both records, keep one v=spf1 at the front and one all term at the end, drop duplicates, and publish it as a single TXT record. Delete the other one.

v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net ~all

v=spf1 include:_spf.google.com include:sendgrid.net ~all
Two broken records → one working record

Keep the strictest all you had (-all beats ~all), and check the merged record's DNS lookup count — merging two records can push you over the 10-lookup limit.

Common questions

Doesn't the receiver just use the first SPF record?+

No. RFC 7208 is explicit: if a DNS query returns more than one SPF record, the result is a PermError. Neither record is evaluated. Under DMARC that means SPF contributes nothing and authentication rides on DKIM alone.

Can I have SPF records on both my root domain and subdomains?+

Yes — that's not just allowed, it's good practice. The one-record rule applies per DNS name. yourdomain.com and news.yourdomain.com each get their own single SPF record.

I merged the records — how fast does it take effect?+

As soon as DNS propagates, typically minutes to an hour depending on the old record's TTL. Receivers evaluate SPF live on every message, so there's no queue to clear.

More free checks