Two SPF records on one domain: how to merge them

Verdict: Broken: SPF fails for all your mail until you merge them. A domain may publish only one SPF record. With two or more, receivers stop and return permerror, so SPF fails for every message, including mail from your main mailbox (RFC 7208 §4.5). Merge them into one record: v=spf1, every include, ip4 and ip6 from both, and one all at the end. Then delete the extra record.

What counts as a second SPF record

Every TXT record at the same name (usually your root domain, @) that starts with v=spf1 is an SPF record. RFC 7208 §3.2 says a domain name "MUST NOT have multiple records that would cause an authorization check to select more than one record". When a receiver finds more than one, the check returns permerror (§4.5), which means "the domain's published records could not be correctly interpreted" (§2.6.7). It usually happens when a new service's setup page says "add this TXT record" and it goes in next to the existing one instead of into it, or when a record from an old host or provider is left behind. Our SPF checker reports it as "2 SPF records found - receivers treat this as a permanent error" and writes the merged record for you.

Does it hurt email delivery?

Yes. permerror isn't a pass, so SPF can't help DMARC for any message. Senders that also sign DKIM with your domain still pass DMARC; every sender that relies on SPF alone fails it, and with p=quarantine or p=reject that mail goes to spam or bounces (Gmail: 550 5.7.27, 550 5.7.26).
Receivers write the result into a delivered message's Authentication-Results header as spf=permerror: open the message's headers to see it.
Not a problem: one record split into several quoted strings, such as "v=spf1 include:_spf.google.com" " include:spf.mailjet.com ~all". Receivers join the strings "without adding spaces" (RFC 7208 §3.3), so one of the strings must carry the space, as the second one does here.
Also not a problem: SPF records at different names. A record at mail.yourdomain.com or bounce.yourdomain.com is separate from the one at yourdomain.com, and other TXT records at the root (site verification codes, for example) don't count.

What to do

List what's there. Run the checker, or nslookup -type=TXT yourdomain.com (Windows) or dig +short TXT yourdomain.com (Mac, Linux). Copy every line that starts with v=spf1.
Keep each sender that still sends for you: every include:, ip4:, ip6:, a and mx from all the records, once each. Drop services you no longer use; an include for a cancelled tool only costs lookups.
Write one record: v=spf1, then the mechanisms, then a single ending: ~all, or -all when every sender is listed (and when your mail provider asks for it, as Microsoft 365 does).
Count the DNS lookups. include, a, mx, ptr, exists and redirect each cost one, nested includes count too, and the whole record may use at most 10 (RFC 7208 §4.6.4). Merging two records can push you over the limit; the SPF checker counts them.
In your DNS panel, change one record to the merged value and delete the other. Don't add a third. Then check again. Receivers may keep the old answer until its TTL runs out.

Merge examples

Google Workspace plus a newsletter tool

Before, two records at yourdomain.com:

v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.mailjet.com ~all

After, one record:

v=spf1 include:_spf.google.com include:spf.mailjet.com ~all

Microsoft 365 plus a record left by your old web host

Before:

v=spf1 include:spf.protection.outlook.com -all
v=spf1 a mx ~all

If the website still sends mail itself (a contact form using PHP mail), keep a, which allows the IP addresses of your root domain's A record:

v=spf1 include:spf.protection.outlook.com a -all

If it doesn't, delete the old record. mx isn't needed for Microsoft 365 mail: its include covers Microsoft's sending servers.

What each include allows and how many lookups it costs: the SPF include directory. Starting over: the SPF generator builds one record from the services you tick. A website form sending through PHP mail is better moved to an SMTP plugin: WordPress form emails going to spam.

Not sure which of the two records is still in use? Merging is easy; knowing which senders are still live, and which ones also need DKIM, is the part that breaks mail. I find every service that sends as your domain (a test email from each, plus your DMARC reports), write the exact record for each one with the clicks for your DNS host, and re-check until SPF, DKIM and DMARC pass.

Get it fixed: $29

Pay by card, no account needed. Within 24 hours; not fixed after you follow the steps, full refund. · Do it yourself: Fix Kit ($15)

Who does the work: me, Ashish, the owner of this site, based in India. My public code and tools are on GitHub: github.com/Donrulezz.

Check what actually matters

SPF, DKIM and DMARC decide whether Gmail, Outlook and Yahoo accept your mail.

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Sources

Did this fix it?