In this guide · 7 sections
Short answer
Edit your existing SPF TXT record and add the new service's include: before the final ~all or -all, for example v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. Never create a second SPF record. Keep the total under 10 DNS lookups, then turn on the service's DKIM so DMARC passes.
The one-record rule
SPF (Sender Policy Framework) is a TXT record on your domain that lists which servers may send email for it. Microsoft's SPF configuration guide is blunt about the most common mistake: only one SPF record is allowed per domain or subdomain, and multiple SPF TXT records for the same name cause SPF to return a permerror, because the receiving system cannot tell which one to use.
That is exactly what happens when someone follows a new tool's instructions literally and adds its record as a second TXT entry starting with v=spf1. From that moment, receivers may treat all mail from the domain as failing SPF.
How to merge a new service into your SPF record
Google's help page Set up SPF explains the format: every SPF record starts with v=spf1, each sender is added with an include: tag, and the record ends with an all mechanism. Google gives worked examples, such as Google Workspace plus Mailchimp: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.
List every service that sends as your domain
Your mailbox provider, newsletter tool, CRM, helpdesk, booking system, accounting software and website contact form. Google's page lists web servers, form services and third-party providers as typical senders.
Get the exact include value from the new service
Copy it from the service's own documentation or DNS settings screen, not from a forum post. Some services ask for an IP address (ip4:) instead.
Edit the existing SPF record
Insert the new include: after the existing ones and before ~all or -all. Keep v=spf1 at the start and only one all at the end.
Save and wait for DNS to update
Microsoft recommends a TTL of at least 3,600 seconds on SPF records. Changes can take up to that long to be seen everywhere.
Check the record and send a test
Look up the record again, then send a test from the new service to a Gmail or Outlook address and read the authentication results in the message headers.
| Before | After adding a newsletter tool |
|---|---|
| v=spf1 include:spf.protection.outlook.com -all | v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all |
| v=spf1 include:_spf.google.com ~all | v=spf1 include:_spf.google.com include:servers.mcsv.net ~all |
The 10-lookup limit
Each include: makes the receiving server look up another DNS record, and those records can contain more includes. The SPF standard, RFC 7208 section 4.6.4, caps this at 10 DNS lookups; go over and SPF returns a permanent error. Microsoft's guide repeats the rule as "fewer than 10 DNS lookups", and Google notes an SPF record can have up to 10 include: tags.
Lookups are counted for include, a, mx, ptr, exists and redirect mechanisms, including the ones nested inside your providers' records. ip4: and ip6: entries do not need a lookup. A record with five includes can already be over the limit if one provider's record contains several more.
If the new service would take you over, do not keep adding. Our guide to fixing too many SPF DNS lookups covers the options: remove services you no longer use, move bulk senders to a subdomain, or rely on DKIM for services that support it.
Set up DKIM for the new service as well
SPF alone is not enough for most third-party senders. DMARC, the policy that tells receivers what to do with failing mail, passes when either SPF or DKIM passes and is aligned with the domain in the visible From address. Many newsletter and CRM tools send using their own return-path domain, so SPF can pass for their domain while not aligning with yours.
DKIM fixes this. The service gives you one or more CNAME or TXT records to add; once verified, it signs your messages with your domain. Microsoft's SPF guide notes that DMARC treats both -all and ~all as SPF failures, and that DMARC reports let you confirm which mail streams pass.
- Add the DKIM records the service gives you, exactly as shown.
- Click verify or authenticate in the service's domain settings.
- Send a test and confirm the headers show dkim=pass for your domain.
- Check your next DMARC aggregate report to see the new service passing.
If DMARC is new to you, our SPF, DKIM and DMARC guide explains how the three fit together.
Should the new service use a subdomain instead?
Microsoft recommends using a subdomain, such as marketing.yourcompany.com.sg, for email services that are not under your direct control, like bulk email services, so that problems with that mail do not affect the reputation of mail sent by staff. The subdomain gets its own SPF record and its own DKIM.
Use your main domain if
- The service sends low volumes of transactional mail, such as invoices or booking confirmations
- Customers expect replies to come from the exact main domain
- Your SPF record has lookups to spare
Use a subdomain if
- You send newsletters or marketing campaigns in bulk
- Your main SPF record is near 10 lookups
- You want marketing problems kept away from staff email
Do it yourself or get help?
Adding one include: to a tidy SPF record is a five-minute DNS edit you can do yourself at your registrar or DNS host. It gets riskier when there are already several services, the record is near the lookup limit, or nobody knows which services still send as the domain.
After adding a new sender
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Emails Land in Spam: Fix (S$249) inventories every service sending as your domain, sets SPF, DKIM and DMARC correctly, checks blacklists and gives a before-and-after test report. If you just need DNS records set up or a domain moved, Domain & DNS Setup (S$99) covers it.
Frequently asked questions
No. Microsoft's documentation says only one SPF record is allowed per domain or subdomain, and multiple SPF TXT records cause SPF to return a permanent error. If a new service tells you to add its SPF record, merge its include: value into your existing record instead of creating a second one.
After v=spf1 and any existing include: or ip4: entries, and before the final ~all or -all. For example, v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. The all mechanism must stay at the end, because anything after it is ignored.
SPF evaluation is limited to 10 DNS lookups in total, and include: entries count, along with nested includes inside your providers' records and mechanisms such as a and mx. Google's help says an SPF record can have up to 10 include tags, but nested lookups often hit the limit sooner. Check the total after every change.
In most cases, yes. DMARC needs SPF or DKIM to pass and align with your From domain. Many third-party services send with their own return-path, so SPF does not align with your domain. Setting up the service's DKIM records lets it sign mail with your domain, which makes DMARC pass reliably.
Google recommends ~all in its Workspace setup page, while Microsoft recommends -all for Microsoft 365 domains that also use DKIM and DMARC. Both are treated as SPF failures by DMARC. Keep whichever your main provider recommends, and do not change it at the same time as adding a new sender.