Multiple SPF records: why you can only have one

A domain may publish only one SPF record. Two or more v=spf1 TXT records on the same domain cause a permerror — the fix is to merge them into a single record.

Why more than one SPF record breaks

RFC 7208 is explicit: a domain that publishes multiple records starting with v=spf1 produces a permerror, and receivers must not choose one arbitrarily. This commonly happens when a new provider’s wizard adds its own SPF record instead of editing your existing one — now you have two.

Wrong — two records

example.com  TXT  "v=spf1 include:spf.protection.outlook.com ~all"
example.com  TXT  "v=spf1 include:_spf.salesforce.com ~all"

Right — one merged record

example.com  TXT  "v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com ~all"

Combine every sender’s mechanisms into a single record with one v=spf1 at the start and one all at the end.

Merging can push you over the limit

Merging is correct — but folding several providers into one record is exactly how domains hit the 10-lookup limit. If your single, correctly-merged record now exceeds 10 lookups, flatten it or move to a macro. Don’t “solve” a lookup problem by splitting into two records — that just trades a lookup permerror for a multiple-record permerror.

Note on multiple strings: one record split across multiple quoted strings (for the 255-character limit) is fine — that is still a single record. See SPF record syntax.