Multiple SPF TXT records — how to merge them

Why multiple SPF records fail

Sender Policy Framework (SPF) is published as a DNS TXT record starting with v=spf1. Receivers look up that TXT set for the sending domain (typically the envelope sender). When two or more SPF TXT strings exist at the same hostname, many receivers treat the result as a permanent error or as “no usable SPF,” which can fail DMARC alignment and spam filters even when every individual include is correct.

This usually happens after someone adds a second vendor’s recommended SPF record instead of merging into the first.

The rule

Only one SPF TXT record should exist at each fully qualified name that sends mail (often the root domain or a subdomain label such as mail.example.com).

You may still have other TXT records (verification strings, DMARC is usually at _dmarc, DKIM is under selectors). The constraint is specifically: one TXT whose value begins with v=spf1 per sending name.

How to find duplicates

1. Look up TXT for the sending hostname in your DNS host panel and with an external resolver.
2. Count how many answers begin with v=spf1.
3. Note every include:, ip4:, ip6:, a, and mx mechanism across those strings so nothing authorized is dropped during the merge.

Example of a broken setup (two separate TXT values):

• v=spf1 include:_spf.google.com ~all
• v=spf1 include:spf.protection.outlook.com -all

Those must become a single record that includes both vendors (and any other senders you still use).

Merge strategy (step by step)

1. Inventory senders. List every service that sends mail as your domain: Google Workspace, Microsoft 365, transactional ESP, WordPress SMTP plugin, marketing tools, and ticketing.
2. Start from one base string. Prefer the record that already covers your primary mailbox provider.
3. Fold in missing mechanisms. Add each unique include: or IP once. Do not paste two complete v=spf1 … all strings into one field.
4. Choose a single “all” mechanism. Use ~all (softfail) while testing, then tighten to -all when confident. Do not leave conflicting endings from old records.
5. Stay under lookup and size limits. SPF evaluation caps DNS lookups (commonly ten). Prefer vendor include: macros over long raw IP lists when the vendor provides them. If the TXT is very long, your DNS host may store it as multiple quoted chunks of the same TXT record—that is different from publishing two SPF records.
6. Delete the extras. After saving the merged string, remove every other v=spf1 TXT at that hostname.

Example merged string (illustrative—use your real includes):

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Verify after you publish

1. Wait for your DNS TTL, then query multiple public resolvers.
2. Confirm exactly one v=spf1 TXT remains.
3. Send a test message from each sending service and inspect authentication results (SPF pass/fail in headers or admin tools).
4. If DMARC is already enforcing, watch aggregate reports for unexpected fails after the change.

Stale caches can briefly hide duplicate TXT strings—re-check after the TTL window.

After you fix SPF

Correct SPF improves trust for outbound mail, including contact-form notifications. It does not prove the form still submits or that your team still receives leads week after week. Plugins break, SMTP credentials expire, and spam folders change. FormReceipt monitors contact forms with scheduled real submissions and inbox confirmation so you catch delivery failures after DNS is healthy.

For SPF concepts and common mistakes, continue with SPF records explained.