How to Merge SPF Records to Fix the ‘Multiple SPF Records’ Error?

It’s a good practice to regularly run your SPF record through a trusted and credible online SPF checker to come across any existing configurational and syntactical errors. This ensures your fortifier against email phishing and spoofing is fit to fight. 

If a lookup tool highlights the existence of multiple SPF records, then you need to merge them into a single consolidated TXT record that is free from errors and redundancies. Let’s see how that’s done. 

What is the ‘Multiple SPF Records’ Error?

As per RFC 7208, SPF allows domain owners to publish one SPF record for a domain to specify which mail servers are officially permitted to send emails on behalf of the domain or organization.

Having multiple SPF records corresponding to a domain is considered an error, which invalidates all the SPF records. This consequently makes your domain vulnerable to phishing and other email-based cybercrimes. Moreover, this can cause email deliverability and impact the sender’s reputation, leading to a dip in email engagement rates. 

Example of a Simple SPF Record

v=spf1 include:_spf.example.com ~all

In this example, the SPF record indicates that the allowed mail servers for the domain are those listed in the “_spf.example.com” record, and it suggests a “soft fail” (~all), which means that the server may accept the email, but mark it as potentially suspicious.

Understanding How to Merge Multiple SPF Records into One

In simpler words, merging SPF records is the process of incorporating all the mechanisms, modifiers, and qualifiers along with their values in one SPF record. Please note that you can’t copy and paste them into a single string; you have to ensure there are no repetitions and everything is technically correct.

A valid SPF record string begins with v=spf1 and ends with ~all or -all. It can end with the +all tag as well, but that’s highly discouraged as it allows anyone on the internet to send emails on your behalf. 

Now, coming to the merging process- we will explain it using the following SPF record example:

v=spf1 include:_spf.google.com ~all

Now, there’s another SPF record-

v=spf1 include:spf.protection.outlook.com ~all

Let’s see the steps to merge them into one:

1. Analyze Existing SPF Records

Review the existing SPF records from all sources. Understand which servers are authorized to send emails on behalf of your domain. Add or remove sending sources, if required. This step is to ensure your SPF record neither permits unauthorized senders nor restricts the authorized ones. 

2. Combine ‘include’ Mechanisms

Merge the “include” mechanisms from each SPF record into a single record. Separate multiple includes with spaces.

Here’s how it will look: 

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

3. Resolve Overlapping Mechanisms

Check for any overlapping mechanisms between the records. If there are redundant mechanisms, eliminate duplicates to avoid conflicts.

4. Define Your SPF Record

Choose the appropriate SPF mechanism for your domain. The example above uses a “soft fail” (~all), which suggests that the server may accept the email but mark it as potentially suspicious.

You can also use the -all tag (hardfail) to instruct recipients’ servers to reject the entry of potentially suspicious messages. 

5. Publish the Merged SPF Record

Go to your domain’s DNS management interface and locate the existing SPF record or an option to add a new one. Then, replace old SPF records with the merged version. 

Save the changes in your DNS settings. Note that DNS changes may take some time to propagate across the Internet.

6. Verify 

After DNS propagation, use online SPF record lookup tools to verify that your SPF record is correctly configured. Tools like MXToolbox or Kitterman’s SPF Query are helpful for this purpose.

By following these steps, you can effectively merge multiple SPF records into a single record, ensuring that your domain’s email authentication is correctly configured and avoiding the “multiple SPF records” error.

Frequently Asked Questions About Merging SPF Records

Here are some common questions and doubts that users or domain owners have regarding SPF records and their merging.

Question 1: What happens if I have two SPF records?

SPF allows only one SPF record per domain. Exceeding this number would affect the authentication process, and your emails can land in spam folders.

Question 2: How do I consolidate my SPF records?

To consolidate SPF records, just include all the parts into one and don’t make any redundancies. 

Question 3: How many lookups can an SPF record have?

There’s a maximum limit of 10 DNS lookups per SPF record. Your record becomes invalid if you exceed this limit. Using an SPF flattener is suggested to resolve this common issue.

Question 4: What is the purpose of merging multiple SPF records?

Consolidating SPF records helps in avoiding conflicts and errors in the email authentication process attempted at the receiver’s end. It’s the process of combining information from various sources into a single SPF record, which ensures accurate authorization of mail servers for a domain.

Question 5: How do I identify the existing SPF records for my domain?

Navigate your DNS settings or get in touch with your hosting provider’s control panel to locate your existing SPF records. These resources are likely to be found under the ‘TXT records’ section.

Question 6: How long does it take for DNS changes to propagate after updating SPF records?

DNS changes typically take some time to propagate across the Internet. It may range from a few minutes to 48 hours, depending on various factors such as TTL (Time to Live) settings.

Question 7: Why monitoring is suggested after merging SPF records?

Monitor your email delivery for any issues. Check email headers to confirm that SPF checks are passing correctly. If you encounter problems, revisit your SPF record and DNS settings to ensure accuracy.

Question 8: How do I choose the appropriate SPF mechanism for my domain?

Determine your preferred SPF mechanism based on your email delivery requirements. The “soft fail” (~all) is commonly used, allowing some flexibility while marking potentially suspicious emails.

Final Words

Ensuring the accuracy of your SPF record helps patch vulnerabilities to give hackers no opportunities to exploit your domain and business. If you have recently switched your hosting provider, there are chances that multiple records are existing for your domain. In such scenarios, employing SPF Flattening can be beneficial. By following the steps outlined above, these records can be consolidated into a single entry, ensuring a streamlined email authentication process and improved email delivery.