Can I use multiple SPF records?

You've got your main server, your ESP, and maybe a CRM or marketing tool all sending email on your behalf. So naturally, you think: can I just create a separate SPF record for each one? Unfortunately, no.

DNS only allows one SPF record per domain. If you publish two, receiving mail servers don't pick the better one. They see a conflict and SPF fails entirely. That means emails that should pass authentication can end up looking unauthorized.

The fix is to combine everything into a single record using include mechanisms. Each include points to a sending source you want to authorize. A record for someone sending from their own server, Mailchimp, and Postmark might look like this:

v=spf1 ip4:203.0.113.10 include:servers.mcsv.net include:spf.mtasv.net ~all

That one record covers all three sending sources. Receiving servers check it once and get the full picture.

The catch: the 10 DNS lookup limit. Each include counts as a DNS lookup, and so do any nested lookups inside those includes. Once you go over 10 total lookups, SPF returns a permerror and fails. This is a real problem for businesses that use several tools (think your ESP, your CRM, your help desk, your transactional mailer).

And if you're running into that limit, there are two practical approaches. First, check whether any of your tools actually send email on your behalf or just let you reply from their interface. Not every integration needs to be in your SPF record. Second, some senders move certain tools to subdomains (like notifications.yourdomain.com) and give each subdomain its own SPF record, which keeps the lookup count manageable.

Not sure if your current SPF record is valid or already over the lookup limit? Our free SPF Checker will show you exactly what's going on in about 30 seconds.