Skip to content

Multiple SPF records found on the domain, causing authentication to fail

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email on behalf of a domain. This check looks for how many SPF records exist. On this domain, more than one SPF TXT record was found, which is invalid under the SPF standard. RFC 7208, the technical standard that defines SPF, specifies that having multiple SPF records on the same domain causes SPF evaluation to fail outright with what's called a PERMERROR, meaning authentication fails completely, exactly the same outcome as having no SPF record at all. This commonly happens by accident when a new email sender, such as Mailgun or SendGrid, is added by creating a second record instead of editing the existing one. Whoever manages the domain's DNS should merge all the separate SPF records into a single record, combining every include directive from each one into one v=spf1 line. This is a DNS change, typically about 15 minutes, and should be checked with an SPF validation tool afterwards to confirm only one record remains.

Why this matters

RFC 7208, the technical standard that defines SPF, specifies that having multiple SPF records on the same domain causes SPF evaluation to fail outright with what's called a PERMERROR, meaning authentication fails completely, exactly the same outcome as having no SPF record at all. This commonly happens by accident when a new email sender, such as Mailgun or SendGrid, is added by creating a second record instead of editing the existing one.

How to fix it

Whoever manages the domain's DNS should merge all the separate SPF records into a single record, combining every include directive from each one into one v=spf1 line. This is a DNS change, typically about 15 minutes, and should be checked with an SPF validation tool afterwards to confirm only one record remains.