Multiple SPF records
More than one SPF TXT record exists, causing evaluation failure.
Problem summary
More than one SPF TXT record exists, causing evaluation failure.
Symptoms
- Two or more TXT records begin with v=spf1 at the same name
- Receivers report spf=permerror
- Validators flag multiple SPF policies
Possible causes
- A second SPF was added instead of editing the existing one
- ESP and IT each published a separate record
- Migration left the old record in place
How to diagnose
- List all TXT answers at the domain (not just the first)
- Identify which mechanisms belong in the surviving record
- Check subdomain SPF separately — only one policy per evaluated name
How to fix
- Merge authorized includes/IPs into one v=spf1 string
- Delete every extra SPF TXT at that name
- Re-check lookup count after the merge
How to verify
- Exactly one v=spf1 TXT remains
- Test messages show spf=pass (not permerror)
Prevention
- Treat SPF as a single mutable record — never “add another SPF”
- Document the owner of the SPF string in runbooks
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts