Can You Have Two SPF Records? (No — and Here's How to Merge Them)

Short answer: no.A domain must publish exactly one SPF record. Publishing two doesn’t combine them — it invalidates both, and receivers return a permerror.

This is one of the most common self-inflicted deliverability wounds, because the intuition is completely reasonable: you added a new sending service, it told you to add an SPF record, so you added one. Now you have two, and authentication is worse than before you started.

Why two records fail

The SPF specification (RFC 7208) is explicit: if a domain returns more than one record starting v=spf1, the result is a permanent error. Receivers don’t pick one, and they don’t merge them — they give up on SPF for that message entirely.

So a domain with:

v=spf1 include:spf.protection.outlook.com -all
v=spf1 include:sendgrid.net -all

authenticates neither Microsoft nor SendGrid. Both were fine individually. Together they cancel out.

How to spot it

Query your TXT records:

dig TXT yourdomain.com +short

Count the lines starting v=spf1. More than one is the bug. The free SPF checker flags it directly.

Note that a domain can legitimately have many TXT records — domain verification, DKIM, site tokens. That’s fine. The rule is specifically one SPF record.

How to merge correctly

Take the mechanisms from every record and put them in one. From the broken example above:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all

The rules that matter:

• One v=spf1 at the start. Never repeat it mid-record.
• One all mechanism, at the very end.Anything after it is ignored — a frequent cause of “I added it and nothing changed.”
• Keep the strictest qualifier. If one said -all and the other ~all, prefer -all once you’re confident the list is complete.
• Deduplicate. The same include twice wastes a DNS lookup against your budget of ten.

The SPF record generatorbuilds a merged record from a list of providers if you’d rather not hand-assemble it.

Watch the 10-lookup limit while merging

Merging solves the permerror but can walk you into a different one. SPF evaluation allows a maximum of ten DNS lookups; each include, a, mx, and redirect counts, and nested includes count too. Exceed ten and you get a permerroragain — same failure, different cause.

If you’re near the limit, remove services that no longer send, or flatten the record to explicit IPs. Full detail in SPF record syntax and the 10-lookup limit.

Preventing the recurrence

This problem comes back, because the next tool you adopt will also tell you to “add an SPF record.” Whoever edits DNS needs to know the rule is edit the existing record, never add a new one.

Across a client portfolio that’s not a knowledge problem, it’s a detection problem — you won’t be in the room when it happens. Zeqo Mail flags duplicate SPF records and over-limit lookups on every scheduled check, and tells you which domain regressed.