Merge multiple SPF records into one
Two SPF records is a permanent failure — combine them.
10 min
why this matters
The specification allows one SPF record per domain. When receivers find two, the check returns permerror and your authentication fails completely, which is worse than having no record at all.
Step by step
- 1
List every SPF record currently published
Query your TXT records and note each value that starts with v=spf1.
dig +short TXT example.com | grep spf1 - 2
Build one combined record
Keep a single v=spf1 at the start, copy across every include, ip4 and ip6 mechanism from all records, remove duplicates, and end with one all mechanism.
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 -all - 3
Delete the old records
Remove every other SPF TXT record so only the merged one remains. Leave your other TXT records — DKIM, DMARC, verification strings — untouched.
how to check it worked
- Only one v=spf1 record is returned
- An SPF validator reports pass with no permerror
related guides
Publish an SPF record
Tell mailbox providers which servers are allowed to send email as your domain.
Set your SPF enforcement correctly
Replace +all or a missing all mechanism with -all.
Get SPF back under the 10-lookup limit
Flatten or consolidate includes so SPF stops returning permerror.
Publish a DMARC record
Add a monitoring DMARC policy and start collecting reports.