More Than One SPF Record Found: How to Merge Them Safely

A domain may publish exactly one SPF record. When a receiver finds two TXT records that start with v=spf1, the standard says the result is a permanent error, and most receivers score that like an outright fail. The second record almost always arrives innocently: a registrar wizard, a second provider's setup page, or a colleague following different instructions. The fix is a merge, not a choice.

Quick answer

List every TXT records (short text lines in DNS used for email security) at the root of the domain and find the ones starting with v=spf1. Build a single record that contains all the mechanisms from both, in any order, with a single ~all or -all at the end. Publish it, delete the others, and run the SPF checker to confirm one record under ten lookups.

How the second record gets there

• The registrar added a default SPF when you bought the domain or enabled its email forwarding, and you added your provider's record alongside it.
• You moved providers and followed the new one's instructions without deleting the old record.
• A website or CRM vendor told you to "add this SPF record" and you added it as a new entry instead of merging.
• Google Workspace or Microsoft 365 setup wizards created one through the registrar's API while a manual record already existed.
• Two people managed DNS and each added their own.

Merge them: a worked example

Suppose the domain has these two records:

v=spf1 a:mail.oqumail.com ~all
v=spf1 include:_spf.google.com include:sendgrid.net -all

The merged record keeps every mechanism once and one all mechanism. Pick the stricter -all only if every legitimate sender is listed; otherwise keep ~all:

v=spf1 a:mail.oqumail.com include:_spf.google.com include:sendgrid.net ~all

Step by step

1. Open the DNS panel at your registrar or DNS host and filter TXT records on the root (@ or blank host).
2. Copy each v=spf1 record into a text editor.
3. Write one new record: v=spf1, then every unique include, a, MX (Mail Exchanger — where incoming email is delivered), ip4 and ip6 term from all of them, then a single ~all or -all.
4. Count the lookups: each include, a, MX (Mail Exchanger — where incoming email is delivered) and redirect costs one, and includes nest. Stay under ten; the lookup guide shows what to cut if you are over.
5. Edit one of the existing records to the merged value and delete the other. Never leave the old one "just in case".
6. Wait for the old records to expire from caches, usually within an hour, then re-check with the SPF checker.

Mistakes that keep it broken

• Two all mechanisms in one record. Everything after the first all is ignored, so a later include does nothing.
• A record that contains v=spf1 twice because two were pasted into one value.
• Deleting the wrong record and losing the mechanism your current provider needs. Merge first, then delete.
• Leaving a TXT records (short text lines in DNS used for email security) for a host like mail.yourdomain.com that also starts with v=spf1. Subdomains have their own SPF; only the root is checked for mail from the root, so that one is harmless but confusing.
• Putting SPF into an SPF-type DNS record. That record type is obsolete; receivers read TXT.

Common questions

Can I keep two records if they list the same things?

No. Receivers do not compare them; they see two and stop. One record, always.

My registrar says a record already exists and will not let me add one. What now?

That is the right behaviour. Edit the existing record instead of adding a new one, and paste the merged value into it.

How long until bounces stop?

As soon as receivers fetch the new record, which happens when the old record's TTL expires. Most zones use an hour or less; see how long DNS propagation takes.

Want to see how your own domain is set up? Use the free SPF checker and MX lookup: they run in your browser and store nothing.