Several SPF records on one domain

What it means

SPF is a TXT record in your DNS that starts with v=spf1. The rules say a domain can have only one such record. If a receiving server finds two, it cannot know which one to trust, so it gives up and returns a "permerror" (permanent error).

This usually happens when you add a new service and follow its setup guide literally: "add this TXT record". You end up with one record for your mailbox provider and another one for your newsletter tool.

Why it matters

With two SPF records, SPF fails for all your emails, not only for the new service. Your messages lose an important proof of identity, DMARC can fail, and delivery to Gmail and Outlook suffers.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. SPF shows "permerror" when several records are found.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

The Domain scanner shows every SPF record it finds, so you can see them side by side.

How to fix it

1. Open your DNS provider and list all TXT records on the domain itself (host @ or empty).
2. Find every record that starts with v=spf1. Other TXT records (Google site verification, etc.) are fine and must stay.
3. Merge them into one line. Keep a single v=spf1 at the start, put all the include:, ip4: and other parts in the middle, and a single ~all or -all at the end.
4. Save the merged record and delete the others.

Example

Before, two records:

v=spf1 include:_spf.google.com ~all
v=spf1 include:servers.mcsv.net ~all

After, one record:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Tips

• If the two records end differently (~all and -all), keep ~all until you are sure all your senders are listed.
• Old "SPF" type records (not TXT) are obsolete. If your DNS provider still shows one, delete it and keep only the TXT record.
• Merging many services can push you over the limit of 10 DNS lookups. The Domain scanner shows the count: stay at 10 or below.
• Subdomains are separate: yourdomain.com and news.yourdomain.com can each have their own single SPF record.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Run the Domain scanner again: only one SPF record should appear, marked as valid. Then send a test email from the home page. SPF should now pass.