A domain may publish exactly one TXT record that starts with v=spf1. If a receiver finds two or more, SPF evaluation ends with permerror; neither record is used. RFC 7208 §4.5 says: “If the resultant record set includes more than one record, check_host() produces the ‘permerror’ result.” The fix is to combine the senders of both records into one record, delete the other, and check the lookup count afterwards with the SPF checker.
Why it happens
Each provider’s setup page shows a complete example, such as v=spf1 include:... ~all. Adding the second provider’s example as a new TXT record, instead of adding its include: to the existing one, produces two records. It also happens when a registrar or website builder adds an SPF record automatically.
Records that do not begin with v=spf1 (followed by a space or the end of the text) are not counted, so a domain verification TXT record next to your SPF record is fine.
Include values for common providers
The values below come from the providers’ own documentation, as recorded in this site’s provider data. Check the linked page for your region or plan.
| Provider | Include to add | Source |
|---|---|---|
| Google Workspace | include:_spf.google.com | https://knowledge.workspace.google.com/admin/security/set-up-spf |
| Microsoft 365 | include:spf.protection.outlook.com (GCC High/DoD: spf.protection.office365.us; 21Vianet: spf.protection.partner.outlook.cn) | https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure |
| Zoho Mail | include:zohomail.com (include:one.zoho.com for multiple Zoho services) | https://www.zoho.com/mail/help/adminconsole/spf-configuration.html |
| Fastmail | include:spf.messagingengine.com | https://www.fastmail.help/hc/en-us/articles/1500000280261-Domain-set-up-MX-only |
Merge step by step
- List the TXT values at the domain name itself (not at subdomains) and note every value starting with
v=spf1. The DNS lookup shows them. - Collect all
include:,ip4:,ip6:,aandmxterms from each record. - Write one record:
v=spf1, then the terms with duplicates removed, then oneallmechanism last. - Add the new value, delete the old ones, then check.
Before:
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
example.com. 3600 IN TXT "v=spf1 include:spf.protection.outlook.com -all"
After:
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all"
Keep one ending. When the originals disagree between ~all and -all, choose by the rule in SPF softfail vs fail. Mechanisms placed after all are never evaluated (RFC 7208 §5.1).
Watch the 10-lookup limit
Merging puts every provider’s includes under one budget of 10 DNS-querying terms (RFC 7208 §4.6.4), and each include can contain more includes. Two records that each worked on their own can fail together. Run the checker after the change and read the count. If it is over, follow SPF too many DNS lookups. If you only need the check for one provider’s records, the provider setup check compares your domain with that provider’s documented values.
Do not keep the second record “for later” on the same name. A subdomain can carry its own SPF record, and that is the legitimate way to separate senders: mail sent with an envelope sender at news.example.com is evaluated against that subdomain’s record. See How to set up an SPF record.
Trade-offs
A merged record authorizes everything either record allowed. If the two records belonged to different teams, you have widened the permitted senders for each. Review the list before publishing. Receivers also handled the permerror differently, so expect a change in delivery once SPF starts to pass and fail as written.
FAQ
Is a long TXT value split into two quoted strings a “second record”? No. Several strings inside one TXT record are concatenated. Two separate TXT records are the problem.
Which record do receivers use if there are two? Neither. The result is permerror (RFC 7208 §4.5).
Do I need to merge _spf records on subdomains too?
Each name is evaluated on its own. Fix every name that has more than one v=spf1 record.
Sources
- RFC 7208, §4.5 Selecting Records: https://www.rfc-editor.org/rfc/rfc7208#section-4.5
- RFC 7208, §4.6.4 DNS Lookup Limits: https://www.rfc-editor.org/rfc/rfc7208#section-4.6.4
- RFC 7208, §5.1 “all”: https://www.rfc-editor.org/rfc/rfc7208#section-5.1
- Google Workspace SPF: https://knowledge.workspace.google.com/admin/security/set-up-spf
- Microsoft 365 SPF: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure
- Zoho Mail SPF: https://www.zoho.com/mail/help/adminconsole/spf-configuration.html
- Fastmail domain setup: https://www.fastmail.help/hc/en-us/articles/1500000280261-Domain-set-up-MX-only