Two SPF Records? Why It Breaks Your Email and How to Merge Them

Here’s a mistake that breaks email for thousands of businesses, and it usually starts with good intentions. You sign up for a new email platform, it tells you to “add this SPF record to your DNS”, and you add it. The problem is that you already had one.

A domain can only have one SPF record. With two, SPF doesn’t check both and pick the best result. It fails completely.

Why two SPF records break SPF

The SPF standard (RFC 7208) is explicit: a domain must not publish more than one SPF record. When a receiving server looks up your domain and finds two TXT records that start with v=spf1, it returns a PermError (“permanent error”) and stops. Neither record is used.

In practice that means:

• Every email from your domain fails SPF, including your normal day-to-day email from Microsoft 365 or Google Workspace.
• DMARC can only pass through DKIM. Any service that isn’t signing with DKIM for your domain will fail DMARC.
• Emails to Outlook and Hotmail can be refused with 550 5.7.515 errors, and once your DMARC policy is quarantine or reject, failing emails go to spam or bounce.

How to check if you have two SPF records

Look at the TXT records on your root domain (the one shown as @ or left blank in most DNS panels). Count how many start with v=spf1. More than one means you have the problem.

Common giveaways:

• One record from your mailbox provider and a second added later by a marketing, CRM or helpdesk platform.
• An old record left behind after moving from one email host to another.
• A record added by your web host or domain registrar automatically, alongside the one you created.
• A v=spf2.0 record (an old Microsoft “Sender ID” format). It isn’t a second SPF record in the same sense, but it’s obsolete and worth removing while you’re there.

Our free checker reads your SPF record and flags this instantly. The link is at the end of this post.

How to merge them into one

Say you have these two records:

v=spf1 include:spf.protection.outlook.com -all
v=spf1 include:_spf.your-email-platform.com ~all

Merging them takes four steps.

1. Keep one v=spf1 at the start

Every SPF record starts with v=spf1, exactly once.

2. Combine all the mechanisms in the middle

Take every include:, ip4:, ip6:, a and mx from both records and list them once each, separated by spaces. Remove duplicates.

3. Keep one all at the end

Choose a single ending. ~all (soft fail) is the common choice while you’re setting things up, and -all (hard fail) is stricter. Don’t include both, and make sure all is the last thing in the record. Anything after it is ignored.

4. Delete the old records and publish the merged one

v=spf1 include:spf.protection.outlook.com include:_spf.your-email-platform.com ~all

Publish this as the only SPF TXT record on your root domain, then delete the others.

Before you merge: two things to check

Do you still need every entry?

Merging is a good moment to remove services you no longer use. It’s also worth checking whether a platform needs to be in your SPF at all. Many marketing platforms use their own bounce domain, so your SPF isn’t what they’re checked against. They pass DMARC through DKIM signed with your domain instead.

Will the merged record go over 10 lookups?

Combining two records often pushes you over SPF’s 10-lookup limit, which causes a different PermError. If that happens, our guide to fixing “too many DNS lookups” covers how to trim it back.

What about subdomains?

The one-record rule applies per domain name. yourdomain.co.uk and news.yourdomain.co.uk can each have their own SPF record. That’s a useful way to give a marketing platform its own SPF without touching the record your main email depends on.

After you’ve fixed it

• Wait for DNS to update (usually minutes, occasionally a few hours).
• Re-check that exactly one v=spf1 record exists.
• Send a test email from each service and check the headers show spf=pass.
• Keep an eye on your DMARC reports for a week to confirm everything is passing.