webzod
account

Merge the SPF records into one

email.spf.multiple · effort: minutes

Why it matters

A domain may publish only one SPF record, and with two or more receivers treat SPF as a permanent error, so legitimate mail can fail too. This usually happens when each mail service asks you to add its own record.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. List every TXT record at the domain that starts with v=spf1 and copy the include, ip4, ip6, a and mx terms from each of them.
  2. Write one record: v=spf1, then every distinct term once, then a single all mechanism at the end (~all while testing, -all when sure). Do not repeat v=spf1 or put terms after all.
  3. Edit one existing record to hold the merged text and delete the others. Doing it in this order means there is never a moment without SPF.
  4. Afterwards check the merged record is within 10 DNS lookups (include, a, mx, ptr, exists and redirect each count); see the too-many-lookups fix if not.
dns 
; Before: two records, one per provider (invalid)
;   example.com.  IN TXT  "v=spf1 include:_spf.provider-one.example ~all"
;   example.com.  IN TXT  "v=spf1 include:_spf.provider-two.example ~all"
; After: one record holding both
example.com.  IN TXT  "v=spf1 include:_spf.provider-one.example include:_spf.provider-two.example ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.