Multiple SPF Records: How to Merge Them Safely

Why two SPF records break authentication

A receiving server expects one SPF policy for a domain. If DNS returns more than one TXT record beginning with v=spf1, the receiver cannot choose between them and normally returns SPF permerror. Adding a second record for a new email service is therefore not a safe way to extend SPF.

Unrelated TXT records, such as site verification tokens, can stay separate. Only the records that begin with v=spf1 need to be combined.

How to merge SPF records

List the mechanisms from both policies, remove the extra v=spf1 prefix, and keep one all mechanism at the end. For example, merge Google Workspace and a marketing platform into one value: v=spf1 include:_spf.google.com include:send.example.net ~all.

Do not copy mechanisms for services that no longer send mail. Every include can trigger more DNS lookups, so merging records without cleaning them up may solve the duplicate-record error while creating a lookup-limit error.

Test before deleting the old records

Build the combined value, compare it with an inventory of active senders, then replace the old SPF records in one DNS change. After propagation, confirm that the checker finds one policy and review real message headers from every service.