DNS guides

SPFBreaks authentication

Multiple SPF records: why it breaks SPF and how to merge them

Two v=spf1 records on one domain make SPF fail everywhere. Merge them into a single record without losing any sender.

What it means

A domain may publish only one TXT record that starts with v=spf1. When a receiver finds two or more, the SPF standard says the result is a permanent error (permerror), whatever the records contain.

This usually happens when a new tool's setup guide says "add this SPF record" and it gets added next to the old one instead of merged into it.

Why it matters for cold email

A permerror means none of your mail passes SPF, even from servers you listed. Your DMARC result then depends on DKIM alone, and some receivers treat the broken record itself as a spam signal.

How to fix it

  1. Copy every v=spf1 record on the domain.
  2. Make one record: v=spf1, then every include, ip4, ip6, a and mx mechanism from all of them, each once.
  3. End it with a single ~all or -all.
  4. Replace the old records with the merged one, then re-check the domain.

Google Workspace plus a sending tool

Before

v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net ~all

After

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Questions

Does an empty or broken second record count?

Yes. Any TXT record that starts with v=spf1 counts, even a malformed one. Remove the ones you don't need.

Will merging push me over the 10-lookup limit?

It can, because every include costs at least one lookup. Run the checker after merging: it counts the lookups the merged record needs.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works