Two SPF records break SPF

A mail service's setup guide usually asks you to add a TXT record that starts with v=spf1. If your domain already has one, adding another means mail from every sender on the domain stops passing SPF.

Here are the TXT records at example.com before and after a new service's record went in:

Before: v=spf1 mx ~all
After:  v=spf1 include:_spf.example.net ~all
        v=spf1 mx ~all

RFC 7208 lets a receiver use only one SPF record per name. When it finds two, it reads neither and returns permerror. The standard says this "definitely requires DNS operator intervention". The mail that used to pass on the old record now has to pass DMARC on DKIM alone.

Merge them into one record

Keep one record that starts with v=spf1 and move every term from the other into it, such as include, ip4, and ip6. Keep a single all at the end because receivers never test terms after it:

v=spf1 mx include:_spf.example.net ~all

If the domain has no SPF record at all, get the correct one from your mail provider and add it to DNS.

How we check your SPF record

Add a DNS monitor for example.com and pick SPF as the record type. A new monitor ticks SPF present, No duplicate SPF record and the checks whose failure makes receivers return permerror, such as Within 10 DNS lookups. The record added above breaks No duplicate SPF record. A DNS move that drops the only SPF record breaks SPF present. We alert only when an assertion you've ticked breaks or recovers. If two SPF records are already present, the first scan shows the duplicate.

What the check misses

We follow include and redirect terms and count the DNS lookups they cost on every scan. We don't expand macros such as %{i}, and we don't count the address lookups behind each mx host. We also don't check DKIM or read DMARC reports.