Finding: Multiple SPF Records Published
This finding means your domain publishes more than one TXT record beginning with v=spf1. RFC 7208 allows exactly one, so this looks configured but functions identically to having no SPF record at all.
Last updated August 11, 2026.
What it means
Nivaronix's TXT lookup on your domain returned more than one record starting with v=spf1. This usually happens when a second service (a new mail provider, marketing tool, or migration script) adds its own SPF record instead of merging its include: into the existing one.
Why it matters
RFC 7208 permits exactly one SPF record per domain. When a receiver's lookup finds more than one, the specification requires it to treat SPF as a permanent error and ignore it entirely — not to pick the "best" one, or merge them. The practical effect is the same as publishing no SPF record at all, except it is harder to notice: a quick DNS check shows SPF-looking records present, so the gap tends to go unfixed for longer than a straightforwardly missing record would.
What Nivaronix checks
Nivaronix performs a live TXT lookup on your domain and isolates every record beginning with v=spf1. This finding fires when more than one is found.
Example evidence (illustrative — not live scan data)
TXT example.com: v=spf1 include:_spf.google.com -all | v=spf1 include:sendgrid.net ~all
How to fix it
- At your DNS host, find every TXT record on the domain that begins with
v=spf1. - Combine every
include:andip4:/ip6:mechanism from all of them into a single record. - Delete the other SPF records, leaving exactly one, ending in
-all.
How to verify the fix
Re-run the SPF & DMARC checker and confirm it now reports exactly one SPF record.