Two selected SPF policies at one DNS name cause permerror. Learn how that differs from unrelated TXT records and multiple strings inside one record.
Adding a newsletter platform or a transactional email service can expose a small but important domain setup mistake: two separate SPF policy records published at the same DNS name. They do not act as a primary policy and a backup. Under RFC 7208, more than one selected SPF record produces permerror . That rule does not mean your domain can have only one TXT record. Verification records can coexist with an SPF record.
A single TXT record can also contain more than one character string without becoming two records. The useful first question is not how many rows appear in the dashboard. It is which records an SPF check selects at the exact name being checked. Start with the name SPF actually checks SPF authorizes sending hosts to use a domain in the SMTP MAIL FROM identity or the HELO/EHLO identity.
That is not simply a check of the address a reader sees in the message From line. Before investigating duplicates, have the mail owner identify the sending service and the domain used for the relevant SPF check. A service may use a dedicated subdomain rather than the main business domain.
Do not assume that every sending tool should receive another TXT record at the apex, or that a record at one name answers a check at another. Two selected SPF records are not two layers of protection RFC 7208 section 4.5 describes record selection: records without the SPF version section are discarded, then the remaining set is counted. If more than one record remains, the result is permerror .
This is an error result, not successful authorization of the combined sender lists. For example, imagine two separate TXT records at example.com , each containing its own policy beginning with v=spf1 . Even if one was added for the main mail service and the other for a new tool, the verifier does not simply try both and accept whichever passes.
This is a hypothetical record arrangement, not a recommended configuration or a test against a live domain. The receiving system decides how to handle the message using its own policy. A duplicate-SPF error is not proof that every message will bounce, nor a guarantee that a corrected SPF configuration will reach every inbox.
Three things that can look similar in a DNS editor Two separate SPF policy records at the same name: if both are selected by the SPF check, the result is permerror . A second record is not a backup policy. One SPF record plus unrelated TXT records: a site-verification TXT record that does not have the SPF version section is not a second SPF policy.
Do not delete unrelated verification records merely to reduce the TXT count. Several strings inside one TXT record: this can still be one record. RFC 7208 section 3.3 says the strings are treated as concatenated without adding spaces. That DNS representation is different from publishing multiple separate SPF records.