More than one SPF record published
Two or more SPF records exist. Receivers treat this as a permanent error and SPF fails outright.
Check your own domain
What causes this
RFC 7208 allows exactly one SPF record per domain. When a receiver finds two, it does not merge them or pick the more permissive one — it returns permerror and stops. This almost always happens when a second sending service is onboarded and its setup guide says to 'add this TXT record', so a new record is created alongside the existing one instead of the include being merged into it.
What it breaks
SPF evaluates to permerror for every message you send, which most receivers treat as a failure. Any DMARC policy that relies on SPF alignment stops working. This is the single most common self-inflicted email authentication fault.
How to fix it
Merge every record into one, keeping all mechanisms, then delete the extras.
- Copy every mechanism (include:, a, mx, ip4:, ip6:) from all of the SPF records you have.
- Build a single record beginning with v=spf1, containing each of those mechanisms once, ending with a single all mechanism.
- Publish that one record.
- Delete the other SPF records. Only TXT records starting with v=spf1 count — other TXT records are unaffected and must be left alone.
- Re-check the domain to confirm exactly one record is now returned.
Specification: RFC 7208 — Sender Policy Framework
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.