More than one SPF record
Your domain publishes more than one v=spf1 TXT record. RFC 7208 forbids this, and an evaluator returns permerror rather than picking one — so having two records is worse than having either one alone. This page covers why duplicates appear, how to see all of them, and how to merge them without losing a sender in the process.
Measured 2026-09-08: 10 of 320 audited domains (3.12%) published more than one SPF record. These are domains someone had a reason to check, so this is an upper bound and not an internet-wide rate — method, window and exclusions in SPF Observatory 2026.
What was observed
A TXT lookup on the domain returned two or more separate strings each beginning v=spf1.
What causes it
These are protocol and measurement causes only. We do not speculate about what a receiver did with the result.
- Two providers each added a record during setup, neither checking for one.
- A record was edited by adding a new TXT entry rather than changing the existing one.
- A migration copied the old record across and created a second.
- An
spf2.0/prarecord mistaken for a duplicate — it is not one, see below.
How to verify it yourself
- List every TXT record, not just the first
dig +short TXT example.com - Count the SPF ones
dig +short TXT example.com | grep -c spf1
Check this record Reads the live record and counts every DNS lookup it costs.
The safe fix, and what it can break
Merge the mechanisms into one record and delete the others. Take every include, ip4 and ip6 from both, drop exact duplicates, and keep one qualifier at the end. Publish the merged record first, confirm it resolves, then remove the second.
What can break: Deleting the wrong record loses whichever senders only it covered, and nothing reports that until their mail fails. Merge before you delete, and keep the count of lookups under ten while you do — two merged records often exceed it.
Examples
example.com. TXT "v=spf1 include:_spf.google.com ~all"
example.com. TXT "v=spf1 include:sendgrid.net ~all"v=spf1 include:_spf.google.com include:sendgrid.net ~all"v=spf1 include:_spf.google.com " "include:sendgrid.net ~all"What the standard says
RFC 7208 §3.2: “A domain name MUST NOT have multiple records that would cause an authorization check”
What happens when a domain publishes two SPF records?
Evaluation returns permerror. RFC 7208 §3.2 states a domain “MUST NOT have multiple records that would cause an authorization check”, and evaluators do not choose between them.
Why do duplicate records appear?
Two providers each adding one during their own setup wizard is the common case. Neither checks whether a record already exists, and DNS panels happily accept a second TXT entry.
How do I list every TXT record on my domain?
dig +short TXT example.com. It returns all of them; a panel that shows one row may be hiding the other.
How do I merge two records into one?
Concatenate the mechanisms, drop exact duplicates, keep a single trailing qualifier. Then re-count lookups: two merged records frequently exceed ten.
Can subdomains have their own record?
Yes, and they often should. SPF is not inherited, so a subdomain with no record of its own evaluates to none rather than to the parent's policy.
Does an spf2.0/pra record count?
No. That is Sender ID, a different scheme with a different version tag. It does not trigger the multiple-record rule, though it is rarely useful now.
Is a multi-string TXT the same as two records?
No. DNS splits strings longer than 255 characters, and an evaluator concatenates them into one record. Two records is the fault; two strings in one record is normal.
What we do not claim
We report what your DNS publishes and what an evaluator would return from it. We do not state what any mailbox provider will do with that result: those decisions are theirs, they are not published, and we cannot measure them from here.
Reviewed by Venkat Nookala, last reviewed 2026-09-08.