A domain should have exactly one SPF record. The SPF standard (RFC 7208) explicitly states that if a domain has more than one SPF record, the result is a permanent error, which means email receivers will reject or fail authentication for messages sent from that domain. Every sending source you use must be consolidated into that single record.
This rule applies regardless of how many email service providers or tools you send through. Whether you use one platform or five, the SPF configuration for your domain must fit within a single DNS TXT record. The sections below walk through the most common questions around SPF setup, including what to do when you have multiple senders, how to avoid lookup limits, and how to verify your configuration is working correctly.
Can a domain have more than one SPF record?
No, a domain cannot have more than one SPF record. According to RFC 7208, the specification that governs SPF, a domain must publish only one SPF record. If a receiving mail server queries your domain and finds two or more records that begin with v=spf1, it will return a PermError, which causes SPF authentication to fail entirely for that domain.
This is one of the most common SPF misconfigurations organizations run into, especially after adding a new email tool or marketing platform. A developer adds a new TXT record without realizing one already exists, and suddenly both records are live. The fix is straightforward: combine all your authorized sending sources into one record and delete the duplicate.
What happens if you have two SPF records on one domain?
If your domain has two SPF records, receiving mail servers will return a PermError during the SPF lookup. A PermError is treated as an authentication failure, which means emails sent from your domain may be rejected, sent to spam, or marked as unauthenticated. This can directly harm your deliverability and sender reputation.
The impact is not gradual. Unlike a soft fail or a neutral result, a PermError is a hard outcome. Mailbox providers that enforce strict DMARC policies may reject messages outright when SPF returns a PermError. Even providers with more lenient filtering will treat the result as a negative signal. If you are troubleshooting deliverability problems and suspect duplicate records, checking your DNS for multiple SPF entries should be one of the first steps.
How do you combine multiple senders into one SPF record?
To combine multiple senders into one SPF record, include all authorized sending IP addresses and services within a single TXT record using the include: mechanism, ip4: or ip6: directives, and a single ending qualifier. The record should start with v=spf1 and end with either ~all (soft fail) or -all (hard fail).
Here is an example of what a combined SPF record might look like for a domain that sends through Google Workspace, a marketing platform, and a transactional email service:
- v=spf1 starts the record
- include:_spf.google.com authorizes Google Workspace
- include:sendgrid.net authorizes a transactional email provider
- include:servers.mcsv.net authorizes Mailchimp
- ~all or -all ends the record and defines the policy for unauthorized senders
Each sending platform you use will typically provide its own include: value in its documentation. Gather all of them, combine them into one record, publish it, and remove any previous SPF records from your DNS. Be careful not to add redundant entries, as each include: statement counts toward your DNS lookup limit.
What is the SPF 10-lookup limit and why does it matter?
The SPF 10-lookup limit is a hard constraint defined in RFC 7208 that restricts the number of DNS lookups a receiving server will perform when evaluating your SPF record to a maximum of ten. Mechanisms that trigger lookups include include:, a, mx, ptr, and redirect=. If your record requires more than ten lookups to resolve, the result is a PermError, and SPF authentication fails.
This matters because each email service you add to your SPF record may itself reference additional DNS records. A single include: statement can trigger multiple nested lookups depending on how the provider has structured their own SPF records. Organizations that send through several platforms simultaneously, such as a CRM, a marketing tool, a transactional provider, and a help desk system, can hit the 10-lookup limit faster than expected.
The lookup limit is not about the length of your SPF record. It is about the chain of DNS queries required to fully resolve it. A short-looking record can still exceed the limit if its include: statements resolve to nested records with their own lookups.
What is SPF flattening and when should you use it?
SPF flattening is the process of replacing include: mechanisms in your SPF record with the actual IP addresses they resolve to, reducing the number of DNS lookups required to evaluate the record. Instead of relying on nested DNS queries, a flattened SPF record contains direct ip4: and ip6: entries that require no additional lookups.
You should consider SPF flattening when your SPF record is approaching or has exceeded the 10-lookup limit. It is a practical solution for organizations that send through multiple platforms and cannot reduce the number of authorized senders. Flattening brings the lookup count down to zero or near zero, resolving the PermError caused by exceeding the limit.
However, SPF flattening comes with an important trade-off. When an email provider changes their sending IP addresses, your flattened record becomes outdated and may start blocking legitimate mail. This means a flattened SPF record requires ongoing maintenance. Some tools and services automate this process by monitoring provider IP ranges and updating the record when changes occur. If you flatten manually, build in a process to review and update the record whenever a provider notifies you of infrastructure changes.
How do you check if your SPF record is set up correctly?
To check if your SPF record is set up correctly, use a DNS lookup tool or an SPF validation tool to query your domain’s TXT records. You should verify that only one SPF record exists, that it begins with v=spf1, that it includes all authorized senders, and that it ends with an all qualifier. You should also confirm the record resolves within the 10-lookup limit.
There are several ways to check your SPF configuration:
- DNS TXT lookup: Use a tool like dig or an online DNS lookup service to query the TXT records for your domain. Count how many records start with v=spf1. There should be exactly one.
- SPF validator: Use a dedicated SPF validation tool that checks syntax, counts DNS lookups, and flags errors. These tools will surface PermErrors, lookup overages, and syntax issues.
- Email header analysis: Send a test email and examine the received headers. Look for the Received-SPF or Authentication-Results header to see whether SPF returned a pass, fail, softfail, or error result.
- DMARC reporting: If you have DMARC configured with aggregate reporting, your DMARC reports will show SPF alignment and pass rates across your sending volume, giving you a broader view of how SPF is performing in practice.
Running these checks periodically, not just at initial setup, is important. SPF records can break over time when providers change their infrastructure, when new tools are added without updating the record, or when someone inadvertently adds a duplicate record to DNS.
How Email Industries helps with SPF configuration
Getting SPF configuration right is more involved than it might first appear, especially for organizations sending through multiple platforms or dealing with lookup limit issues. We work directly with businesses to audit, correct, and maintain their SPF setup as part of a broader email authentication and deliverability strategy. Here is what that looks like in practice:
- SPF record audit: We review your current DNS records to identify duplicate entries, syntax errors, missing senders, and lookup limit violations.
- Record consolidation: We combine all authorized sending sources into a single, correctly structured SPF record that covers your full sending infrastructure.
- Lookup limit resolution: When records exceed the 10-lookup limit, we help you evaluate flattening options and implement a maintenance process to keep the record accurate over time.
- Authentication alignment: We ensure SPF works in alignment with DKIM and DMARC so your full authentication stack supports inbox placement and protects your sender reputation.
- Ongoing monitoring: Through tools like Alfred and our deliverability consulting services, we help you stay ahead of configuration drift before it affects your email performance.
If you are unsure whether your SPF record is correctly configured or want a full review of your email authentication setup, feel free to contact us and we will take a look.
Related Articles
- How do email advertising agencies handle crisis management?
- How do email advertising agencies handle creative development?
- What data do you need to transfer during an email platform migration?
- How do you choose the right email platform to migrate to?
- What are the biggest mistakes made during domain warmup?
- How long does a domain warmup take?
- Why is domain warmup important for deliverability?
- What email marketing tools do ecommerce agencies use for online stores?
- What email strategies work best for ecommerce stores?
- What is the difference between general email agencies and ecommerce specialists?
- What is email infrastructure consulting used for?
- What metrics do deliverability agencies use to measure success?
- Can you prevent future blacklisting after removal?
- What ROI can you expect from professional deliverability services?
- How do you choose the best email advertising agency?
