Multiple SPF records (and what to do about it)

Sender Policy Framework (SPF) is a protocol that authenticates outgoing emails to prevent the misuse of your domains by spammers and phishers.

SPF lets you specify which email servers are authorized to send emails on behalf of your domain. These servers are published in DNS records. When receiving servers receive an email, they check the SPF record to verify that it comes from a listed server.

However, a common pitfall in SPF management is creating multiple SPF records for a single domain. According to DNS standards, a domain should have only one SPF record, and having more than one can lead to SPF validation failures. Validation failures increase the likelihood of legitimate emails being marked as spam and complicate the domain’s overall email deliverability.

Having multiple SPF records isn’t just a minor oversight—it’s a serious issue that can undermine your email security efforts. Fortunately, you can do something about it.

Below, we’ll walk you through everything you need to know to identify and resolve multiple SPF records—and we’ll also show you how to automate the process. Whether you are an IT professional, a business owner, or someone tasked with managing email systems, we’ll help you sort out your multiple SPF records.

What is SPF?

An SPF record is a text entry in your domain’s DNS system that lists all the email servers permitted to send email on your behalf. When an email is sent from your domain, the receiving email server checks this record to verify that the email comes from a server authorized by the domain owner.

SPF adds a layer of authenticity to your email transactions, helping to secure email channels from malicious actors. This allows your organization to combat phishing attacks and prevent spoofed email addresses. Without SPF, bad actors could impersonate your brand, tricking recipients into divulging sensitive information, clicking malicious links, or executing harmful transactions.

An SPF record typically starts with the version tag v=spf1, indicating that it is an SPF record and which version of SPF is used. Following this prefix are a series of “directives” that specify which email servers are authorized to send email from the domain and how receiving servers should treat email that doesn’t comply with these directives.

The problem with multiple SPF records

Multiple SPF records can create challenges and complications for email authentication:

• Increased Risk of SPF Failures: Email authentication checks will likely result in permanent errors if a domain has more than one SPF record. Email servers expect to retrieve a single SPF record. When they find more than one, they can’t determine which one to rely on, making it difficult to authenticate the email’s legitimacy.
• Potential Email Rejection: Due to the ambiguity caused by multiple records, receiving email servers might choose to reject emails outright as a precautionary measure. This can occur even if one of the SPF records correctly authorizes the sending server.
• Administrative Overhead: Managing multiple SPF records inadvertently increases administrative overhead. IT teams may spend unnecessary time troubleshooting and rectifying SPF-related issues instead of focusing on other critical tasks.
• Lower Email Deliverability: Since SPF is used to prevent unwanted email (spam), failures in SPF checks due to multiple records can lead to legitimate emails being blocked or sent to the spam folder.
• Loss of Business Communications: Critical business communications could be lost, delayed, or never seen by recipients, potentially leading to lost revenue or harmed business relationships.
• Damaged Sender Reputation: Continuous SPF failures can damage an organization’s sender reputation over time. Email providers may begin to classify emails from the domain as untrustworthy, making it increasingly difficult to reach users’ inboxes.

How to identify multiple SPF records

You might have multiple SPF records and not even know it. First, you’ll need to check and see whether multiple SPF records exist for your domain:

1. Check SPF records using DNS lookup tools

• Select a DNS Lookup Tool: Many online tools are available for performing DNS lookups, such as MXToolbox, Google Admin Toolbox, or Command Line Interface (CLI).
• Perform the Lookup:
  • For web-based tools, enter your domain name in the search box and select SPF record from the options provided.
  • For CLI tools, you can use commands like dig @8.8.8.8 yourdomain.com TXT or nslookup -type=TXT yourdomain.com.
• Analyze the Results: The output will show all TXT records for the domain, which include SPF records (noted by v=spf1 in the record). Carefully review these entries to check for more than one SPF record.

2. Search for redundant or conflicting SPF records

• Look for Multiple Entries: Any instance where you see more than one v=spf1 tag for a domain indicates multiple SPF records. This is usually the primary indicator of a problem.
• Check for Overlapping Entries: Examine the specifics of each SPF record to see if there are overlapping IP addresses, include statements, or mechanisms that could conflict with or duplicate each other.
• Assess All Related Domains: Sometimes, different subdomains might be set up with separate SPF records, which can inadvertently affect each other. Check SPF records for all subdomains associated with the primary domain.

3. Prevent future SPF issues

Identifying and fixing multiple SPF records is one thing, but you’ll have to repeat the remediation process later if you duplicate the problem. Here are a few common scenarios that often lead to multiple SPF records:

• Decentralized Email Management: In large organizations, different departments might manage their own email campaigns and settings, leading to the creation of separate SPF records without coordination.
• Changes in Email Service Providers: Switching email services or adding additional services without properly updating the existing SPF record can result in multiple records.
• Misunderstanding SPF Configuration: Lack of understanding or expertise in managing DNS records can lead to mistakes such as creating new SPF records instead of modifying existing ones.
• Legacy Configurations: As IT infrastructure evolves, legacy SPF records might be forgotten if they aren’t properly audited and updated, resulting in multiple active records.

How to resolve multiple SPF records

If you detect multiple SPF records, you’ll need to consolidate them into a single, comprehensive record. Here’s a step-by-step guide on how to consolidate multiple SPF records (and optimize the final SPF configuration):

1. Compile all existing SPF records

Gather all SPF records associated with your domain. This includes records set at the domain level and any subdomains. List out all the mechanisms and modifiers used in these records, such as include, ip4, mx, etc.

2. Analyze and prioritize the mechanisms

Review each mechanism in your existing SPF records. Prioritize based on:

• Essential IP Addresses: Include IPv4 or IPv6 addresses essential for your email-sending capabilities.
• Third-party Services: Use include statements for essential third-party services like email marketing platforms or externally hosted email services.
• Mail Exchange Records: Include mx if your outgoing emails are sent from your domain’s MX records.
• Legacy or Redundant Entries: Remove outdated or unnecessary entries to streamline the record.

3. Create a single consolidated record

Construct a new SPF record that integrates all essential elements. Start with the version prefix v=spf1, followed by the prioritized mechanisms, and end with an appropriate qualifier like ~all or -all.

Here’s an example of what this might look like:

v=spf1 ip4:192.168.0.1 include:_spf.google.com mx -all

4. Validate the new SPF record

Before going live, validate your new SPF record using SPF record-checking tools. These tools will help you verify that the syntax is correct and that the record doesn’t inadvertently block legitimate email sources.

5. Publish the consolidated SPF record

Replace the existing SPF records in your DNS with the new consolidated SPF record. Double-check that only one SPF record exists for each domain and subdomain.

6. Monitor and adjust as necessary

After updating the record, monitor your email deliverability and check for reports of SPF failures. Be prepared to adjust if issues are reported by your email recipients or detected through SPF failure reports.

Best practices for managing your SPF records

Maintaining your SPF records isn’t a set-it-and-forget-it process—unless you’re using a solution like Valimail to update your records. Here are some best practices to keep in mind when setting up and updating your SPF:

• Regularly Review and Update Your SPF Records: Regularly review your SPF records to ensure they accurately reflect current email-sending sources. This includes removing old or unused IP addresses or domains that no longer send emails on your behalf.
• Avoid Exceeding the 10-Lookup Limit: Each DNS lookup caused by SPF mechanisms (like include, a, mx, ptr, and exists) counts towards this limit. Exceeding the limit can result in SPF validation failures, causing emails to be rejected or marked as spam.
• Never Use SPF Flattening: This technique involves converting all the IPs from the include mechanisms into a list of IPv4 or IPv6 mechanisms in your SPF record. While SPF flattening reduces the number of DNS lookups, it requires frequent updates to ensure accuracy, as the IPs used by your email service providers might change.
• Deploy DMARC: DMARC provides an additional layer of verification to prevent spoofing. It ensures your emails are authenticated by SPF and DKIM.
• Leverage Professional Solutions and Services: Use professional DNS and SPF management solutions (like Valimail) to simplify and automate the complexity of managing SPF records.

Set up your SPF records (the right way) with Valimail

Managing your organization’s SPF records isn’t easy. Overlooking even the tiniest details can lead to multiple SPF records, SPF failures, and compromised security.

Fortunately, you don’t have to handle it all on your own. Valimail provides a streamlined, automated way to manage SPF records accurately and efficiently. Here’s how:

• Automation and Simplification: Valimail automates the creation and maintenance of SPF records. This reduces the risk of human error and ensures that your SPF records are always up to date with the latest sending sources (without exceeding the SPF 10-lookup limit).
• Dynamic SPF Management: Valimail provides advanced solutions like our Instant SPF, which manages the complexities of SPF records without requiring manual updates.
• Visibility and Control: With Valimail, you gain complete visibility into and control over who sends emails on your domain’s behalf. This helps you quickly identify and authorize legitimate sending sources while blocking unauthorized ones.
• Comprehensive Email Authentication Solutions: Valimail doesn’t just manage SPF records—it offers a comprehensive suite of email authentication services, including DMARC, DKIM, and BIMI.

Set up your SPF records the right way with Valimail to protect your domain, boost your deliverability, and secure your digital communications.