Multiple SPF records on one domain (PermError) — how to merge them
A domain must publish exactly one TXT record starting with v=spf1. When a receiver finds two, RFC 7208 §4.5 requires it to return PermError, and in practice that means every SPF check fails — including the ones that used to pass.
This almost always happens when a second vendor is onboarded and their setup wizard adds a record instead of editing the existing one.
The fix is to merge, not to delete: take the include: and ip4: terms from every record, combine them into one, and keep a single terminal all mechanism.
How to fix it
- 1List every TXT record on the apex that begins with v=spf1.
- 2Combine all their mechanisms — include:, ip4:, ip6:, a, mx — into one record, removing exact duplicates.
- 3Keep exactly one terminal mechanism at the end (~all or -all).
- 4Delete the other SPF records entirely. Do not leave one with just v=spf1.
- 5Check the merged record still consumes 10 or fewer DNS lookups.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored