Email & deliverability2 min readUpdated 2026-07-09

How to fix multiple SPF records (and the 10-lookup limit)

Two SPF records break SPF for all your mail. Here's how to merge them into one valid record and stay under the 10-lookup limit.

SPF (Sender Policy Framework) lists which servers may send mail for your domain. RFC 7208 allows exactly one SPF record. Publish two and receivers get a PermError — SPF fails for all your mail, even from legitimate senders. It's one of the most common and most damaging email misconfigurations.

Diagnose the problem#

Look at your domain's TXT records. If more than one starts with v=spf1, you have the problem:

v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net ~all   ← second record = PermError

The SPF Checker flags both duplicate records and the lookup count in one step.

Merge into one record#

Combine every sending source into a single record. Merge the two above into:

v=spf1 include:_spf.google.com include:sendgrid.net -all

Keep one v=spf1 at the start and one all mechanism at the end.
End with -all (hard fail — reject others) or ~all (soft fail — accept but mark). Prefer -all once you're sure every sender is listed.
Never use +all — it authorises the entire internet to send as you.

Stay under 10 DNS lookups#

SPF also fails with PermError if evaluating it needs more than 10 DNS lookups. Each include:, a, mx, ptr, exists and redirect counts (and includes nest).

Remove sources you no longer use.
Prefer ip4:/ip6: for fixed IPs — they cost zero lookups.
If you're still over, use SPF flattening (replace includes with their resolved IPs) — but automate it, because those IPs change.

Frequently asked questions

▸ Can I have two SPF records if they're for different subdomains?

Yes — the one-record rule is per hostname. example.com and mail.example.com each may have their own single SPF record. The problem is two records on the same name.

▸ Should SPF end with -all or ~all?

-all (hard fail) tells receivers to reject unlisted senders; ~all (soft fail) tells them to accept but treat as suspicious. Use ~all while testing, then move to -all once you're confident every legitimate sender is included.

▸ What is the SPF 10-lookup limit?

SPF evaluation may perform at most 10 DNS lookups (from include, a, mx, ptr, exists, redirect mechanisms). Exceed it and SPF returns PermError and is ignored. Reduce includes or flatten to fixed IPs.

Do it with a free tool

Related guides

Published 2026-07-09 · Updated 2026-07-09 · By Crawlsonar.