SPF (Sender Policy Framework) is an important email authentication mechanism used to identify which mail servers are authorized to send email on behalf of a domain.

A correctly configured SPF record can help protect a domain against email spoofing and improve email authentication. However, SPF configuration mistakes can also cause legitimate emails to fail authentication.

One particularly common DNS mistake is creating multiple SPF records for the same domain.

For example, an administrator may initially configure Google Workspace:

v=spf1 include:_spf.google.com ~all

Later, another administrator or service provider may add another SPF record:

v=spf1 include:mail.exampleprovider.com ~all

Although both records may individually look correct, publishing them as two separate SPF TXT records at the same hostname is generally incorrect.

The proper approach is normally to combine all legitimate sending sources into one SPF record.

This article explains how to check SPF records using Windows Command Prompt, PowerShell and DNS tools, how to identify duplicate SPF records, and how to troubleshoot common SPF configuration problems.

1. What Is an SPF Record?

SPF stands for:

Sender Policy Framework

It is published in DNS as a TXT record.

A typical SPF record may look like:

v=spf1 include:_spf.google.com ~all

The record tells receiving email systems which servers are authorized to send email using the domain.

For example, if an organization uses Google Workspace for email, its SPF configuration may authorize Google's mail infrastructure.

When an email arrives, the recipient's mail system can evaluate SPF to determine whether the sending infrastructure is authorized by the domain's SPF policy.

2. Where Is an SPF Record Stored?

Modern SPF policies are normally published as DNS TXT records.

For example:

Type: TXT
Host/Name: @
Value: v=spf1 include:_spf.google.com ~all

The @ usually represents the root domain.

If the domain is:

examplecompany.com

the SPF policy applies to:

examplecompany.com

DNS providers may use slightly different terminology such as:

• Name
• Host
• Record Name
• Hostname
• Value
• Content
• TXT Value

The concept remains the same.

3. Can a Domain Have Multiple TXT Records?

Yes.

This is an important distinction.

A domain can legitimately have many TXT records.

For example:

google-site-verification=xxxxxxxx

MS=ms12345678

some-service-verification=abcdef

and:

v=spf1 include:_spf.google.com ~all

There is nothing inherently wrong with having multiple TXT records.

The problem occurs when multiple separate TXT records contain independent SPF policies beginning with v=spf1 for the same DNS name.

4. How Many SPF Records Should a Domain Have?

A domain should normally publish one SPF policy for a given hostname.

For example, this is normal:

v=spf1 include:_spf.google.com include:spf.mailprovider.example ~all

However, publishing these separately is problematic:

v=spf1 include:_spf.google.com ~all

and:

v=spf1 include:spf.mailprovider.example ~all

The receiving server is not supposed to simply choose whichever SPF record it prefers.

Multiple SPF records can result in an SPF PermError (Permanent Error).

5. Why Do Duplicate SPF Records Get Created?

Duplicate SPF records often appear after changes to email infrastructure.

For example, a business originally uses one mail provider and publishes:

v=spf1 include:_spf.google.com ~all

Later, another service is introduced.

Someone adds:

v=spf1 include:spf.newsletter.example ~all

instead of updating the existing SPF record.

The DNS zone now contains two SPF policies.

This frequently happens when multiple people have DNS access, including:

• IT administrators
• Web developers
• Hosting providers
• Email providers
• Website agencies
• Marketing agencies
• CRM vendors
• Bulk email providers
• Previous IT support companies

Therefore, SPF should always be reviewed before adding another email-sending service.

6. How to Check SPF Records Using Windows Command Prompt

Windows includes nslookup, which can query DNS directly.

Open:

Command Prompt

and enter:

nslookup -type=TXT examplecompany.com

Replace examplecompany.com with the domain you want to investigate.

For example:

C:\>nslookup -type=TXT examplecompany.com

You may receive:

Server:  UnKnown
Address:  192.168.1.1

Non-authoritative answer:
examplecompany.com    text =

    "v=spf1 include:spf.mailprovider.example include:_spf.google.com ~all"

The important part is:

v=spf1 include:spf.mailprovider.example include:_spf.google.com ~all

Only one SPF record is visible in this example.

7. What Does "Non-authoritative Answer" Mean?

You may see:

Non-authoritative answer:

This does not automatically indicate an error.

It generally means the DNS response came from a recursive DNS resolver rather than directly from the authoritative DNS server for the domain.

For normal troubleshooting, the returned record is still useful.

If necessary, administrators can also query specific DNS resolvers or authoritative nameservers.

8. Correct SPF Example

Consider this SPF policy:

v=spf1 include:spf.mailprovider.example include:_spf.google.com ~all

Breaking it down:

v=spf1

This identifies the TXT content as an SPF version 1 policy.

include:spf.mailprovider.example

This tells SPF to evaluate the referenced provider's SPF policy as an authorized source.

include:_spf.google.com

This authorizes the relevant Google mail infrastructure according to Google's published SPF policy.

~all

This is the SPF soft-fail qualifier for senders that do not match the preceding authorized mechanisms.

The overall structure is:

v=spf1
include:spf.mailprovider.example
include:_spf.google.com
~all

but it is normally entered into DNS as one continuous TXT value:

v=spf1 include:spf.mailprovider.example include:_spf.google.com ~all

9. Example of an Incorrect Multiple-SPF Configuration

Suppose DNS contains:

TXT @ "v=spf1 include:_spf.google.com ~all"

and another record:

TXT @ "v=spf1 include:spf.mailprovider.example ~all"

This is not the proper way to authorize two email systems.

Instead, where appropriate, the mechanisms should normally be consolidated:

v=spf1 include:_spf.google.com include:spf.mailprovider.example ~all

Important: Never combine SPF records blindly.

First determine whether each service is actually authorized and still being used.

An old SPF entry could authorize infrastructure that should no longer be permitted to send email for the organization.

10. How to Check SPF Using PowerShell

PowerShell provides another useful DNS troubleshooting method.

Open PowerShell and run:

Resolve-DnsName examplecompany.com -Type TXT

To focus on SPF-related content, you can use:

Resolve-DnsName examplecompany.com -Type TXT |
Where-Object {$_.Strings -match "v=spf1"}

Review all results containing:

v=spf1

If multiple independent SPF TXT resource records are returned for the same hostname, the DNS configuration should be investigated.

11. Check Using Google Public DNS

You can also bypass the DNS resolver supplied by your router or ISP.

For example:

nslookup -type=TXT examplecompany.com 8.8.8.8

This asks Google's public DNS resolver.

You can similarly query Cloudflare's public resolver:

nslookup -type=TXT examplecompany.com 1.1.1.1

Comparing results can be useful shortly after a DNS modification because different recursive resolvers may temporarily have different cached versions.

12. Why SPF Changes May Not Appear Immediately

DNS changes are not always visible everywhere immediately.

DNS records have a TTL:

Time To Live

Resolvers may cache the previous TXT record until its TTL expires.

Therefore, after changing SPF, one resolver might return the new record while another temporarily returns an older cached version.

Useful checks include:

nslookup -type=TXT examplecompany.com 8.8.8.8

and:

nslookup -type=TXT examplecompany.com 1.1.1.1

If you recently changed DNS, allow for normal DNS caching and propagation behavior.

13. Do Not Confuse TXT Records With SPF Records

Suppose nslookup displays:

"google-site-verification=ABC123"

"MS=ms12345678"

"v=spf1 include:_spf.google.com ~all"

This does not mean there are three SPF records.

There are three TXT records, but only one is an SPF policy.

When checking for duplicate SPF records, search specifically for:

v=spf1

14. Be Careful With Split TXT Strings

DNS TXT data can sometimes be represented as multiple quoted character strings.

For example, a long record might appear visually similar to:

"v=spf1 include:service1.example "
"include:service2.example ~all"

This does not automatically mean that two independent SPF records exist.

The strings may be parts of a single TXT resource record.

Therefore, when investigating duplicate SPF problems, distinguish between:

multiple strings belonging to one TXT record

and

multiple independent TXT records each declaring v=spf1.

15. Check Nested SPF Includes

Finding only one top-level SPF record does not mean SPF is automatically perfect.

Consider:

v=spf1 include:spf.mailprovider.example include:_spf.google.com ~all

The first include:

include:spf.mailprovider.example

may itself contain other SPF mechanisms.

To investigate it:

nslookup -type=TXT spf.mailprovider.example

Similarly:

nslookup -type=TXT _spf.google.com

This helps administrators understand the SPF dependency chain.

16. SPF Has a DNS Lookup Limit

One of the most important SPF troubleshooting rules is the DNS lookup limit.

SPF evaluation limits the number of DNS-query-causing mechanisms/modifiers during evaluation.

A configuration containing too many nested:

include:

entries, redirects or other DNS-querying mechanisms can exceed the permitted lookup limit.

When that happens, SPF may produce a PermError even though the top-level SPF record looks reasonable.

This is particularly important for businesses using many external services such as:

• Google Workspace
• Microsoft 365
• CRM systems
• Helpdesk platforms
• Newsletter systems
• ERP applications
• Website servers
• Transactional email services
• Cloud applications
• Marketing platforms

17. SPF Mechanisms That Need Attention

Common SPF mechanisms include:

include:

a

mx

ip4:

ip6:

exists:

and:

redirect=

Some of these can cause DNS lookups during SPF evaluation.

For example:

ip4:203.0.113.25

directly specifies an IPv4 network/address and does not require the same kind of DNS expansion as an include: mechanism.

18. Understanding ~all

Many SPF records end with:

~all

This means SoftFail for senders that do not match the preceding mechanisms.

Example:

v=spf1 include:_spf.google.com ~all

It indicates that the listed mechanisms identify expected senders, while non-matching sources should be treated as a soft failure according to SPF semantics.

19. Understanding -all

You may also encounter:

-all

This represents a Fail result for senders that do not match the preceding mechanisms.

For example:

v=spf1 include:_spf.google.com -all

Administrators should not switch from ~all to -all simply because it looks more secure.

First verify every legitimate email-sending system used by the organization.

Otherwise, legitimate mail may fail SPF.

20. Be Extremely Careful With +all

A record such as:

v=spf1 +all

is generally highly undesirable.

+all effectively allows every sender to match the SPF policy.

That defeats the purpose of restricting authorized sending sources.

If you discover +all, investigate immediately why it was configured.

21. What About ?all?

You may occasionally see:

?all

This produces a Neutral result.

It provides considerably less restrictive signaling than configurations designed to identify unauthorized senders.

Its use should therefore be intentional rather than accidental.

22. Common SPF Configuration Mistakes

Administrators should look for:

1. Multiple independent v=spf1 TXT records
2. Old email providers still authorized
3. Incorrect include: domains
4. Typographical errors
5. Missing all mechanism
6. Accidental +all
7. Too many DNS lookups
8. Invalid SPF syntax
9. Obsolete mail server IP addresses
10. Forgotten marketing platforms
11. Incorrect IPv4 addresses
12. Incorrect IPv6 ranges
13. Nested includes creating lookup problems
14. SPF records published on the wrong hostname
15. DNS changes that have not propagated as expected

23. How to Audit SPF Safely

Before modifying an SPF record, create an inventory of every legitimate system that sends email using the organization's domain.

For example:

Service	Sends Email?	SPF Authorization Needed?
Google Workspace	Yes	Usually
Microsoft 365	No	No
Website Contact Form	Yes	Depends on delivery method
CRM	Yes	Possibly
Newsletter Platform	Yes	Usually
Accounting Software	Yes	Depends
Local SMTP Server	Yes	Yes
Helpdesk Platform	Yes	Possibly

The exact requirement depends on how each system sends and which domain is used for the SMTP envelope sender/Return-Path.

24. Check SPF Before Removing Any Entry

Suppose you find:

include:spf.oldprovider.example

Do not immediately delete it merely because you do not recognize the hostname.

First determine:

• Who owns or operates the service?
• Is the service currently being used?
• Does any application send email through it?
• Is it connected to a website?
• Does an ERP or CRM use it?
• Is it associated with a bulk-mail platform?
• Is it part of an email security gateway?
• Is it required by an existing SMTP relay?

Removing a legitimate sender can cause SPF failures.

25. Recommended SPF Troubleshooting Workflow

When auditing a domain, use this sequence:

Step 1: Query all TXT records.

nslookup -type=TXT examplecompany.com

Step 2: Count independent records beginning with:

v=spf1

Step 3: If there is more than one, investigate duplicate SPF.

Step 4: Review every mechanism in the SPF record.

Step 5: Investigate every include:.

Step 6: Verify each service is genuinely required.

Step 7: Calculate DNS-query-causing SPF lookups, including nested dependencies.

Step 8: Check ~all, -all, ?all, or +all.

Step 9: Correct the SPF policy carefully.

Step 10: Re-query DNS after the change.

Step 11: Test email authentication.

Step 12: Review DKIM and DMARC as well.

26. SPF Alone Is Not Complete Email Authentication

SPF is only one component of modern domain email authentication.

Organizations should normally consider all three:

SPF

Identifies authorized sending infrastructure.

DKIM

Adds a cryptographic signature to email that recipients can verify using the sender's DNS-published public key.

DMARC

Uses SPF and/or DKIM alignment with the visible From domain and provides a policy/reporting framework.

A domain can therefore have a technically valid SPF record and still have incomplete or poorly configured email authentication.

27. SPF and Email Spoofing

SPF can help reduce unauthorized use of a domain in email, but SPF by itself is not a complete anti-spoofing solution.

For stronger domain protection, organizations should correctly deploy:

SPF
+
DKIM
+
DMARC

DMARC is particularly important because it evaluates alignment with the domain visible to the recipient in the From header.

28. SPF Troubleshooting Checklist

Use this checklist when auditing a domain:

• Query the domain's TXT records

• Find every v=spf1 record

• Confirm only one SPF policy exists for the hostname

• Identify every include:

• Check nested SPF policies

• Review DNS lookup count

• Remove obsolete services only after verification

• Check IP addresses

• Check ~all, -all, ?all, or +all

• Confirm the record is published at the correct hostname

• Allow for DNS caching

• Test using multiple DNS resolvers

• Verify actual mail flow

• Check DKIM

• Check DMARC

• Monitor authentication reports where available

29. Example of a Healthy Basic SPF Result

Suppose this command is executed:

nslookup -type=TXT examplecompany.com

and the SPF-related result is:

"v=spf1 include:spf.mailprovider.example include:_spf.google.com ~all"

Initial observations:

• Only one v=spf1 policy is visible.
• Two sending sources are referenced.
• The policy terminates with ~all.
• No obvious duplicate SPF record appears in this result.

However, a complete audit should still inspect:

spf.mailprovider.example

and:

_spf.google.com

for nested SPF behavior and total lookup implications.

30. Final Conclusion

Checking for duplicate SPF records is relatively simple, but properly auditing SPF requires more than counting TXT records.

Start with:

nslookup -type=TXT examplecompany.com

Then identify how many independent SPF policies begin with:

v=spf1

The most important rule to remember is:

Multiple TXT records are normal. Multiple independent SPF records for the same hostname are not.

If multiple email services need authorization, their SPF requirements normally need to be incorporated into a single valid SPF policy rather than creating separate v=spf1 records.

Administrators should also examine nested include: mechanisms, DNS lookup limits, obsolete services, IP addresses and the final SPF qualifier.

Finally, SPF should be treated as part of a broader email authentication strategy incorporating SPF, DKIM and DMARC.

Frequently Asked Questions (FAQ)

1. Can a domain have multiple TXT records?

Yes. Multiple TXT records are completely normal. The concern is having multiple independent SPF policies beginning with v=spf1 at the same hostname.

2. Can a domain have two SPF records?

It should not publish multiple SPF policies for the same hostname. Multiple applicable SPF records can produce a PermError.

3. How do I check SPF in Windows?

Run:

nslookup -type=TXT examplecompany.com

4. How do I check SPF using PowerShell?

Use:

Resolve-DnsName examplecompany.com -Type TXT

5. Is google-site-verification another SPF record?

No. It is a TXT record, but it is not SPF because it does not begin with v=spf1.

6. Is MS=... an SPF record?

No. It may be a Microsoft domain verification TXT value, but it is not an SPF policy.

7. What does include:_spf.google.com mean?

It references Google's SPF policy so that appropriate Google sending infrastructure can be authorized through SPF.

8. What does ~all mean?

It produces a SoftFail result for senders that do not match the preceding mechanisms.

9. What does -all mean?

It produces an SPF Fail for senders not matched by the preceding mechanisms.

10. Is +all recommended?

Generally, no. It effectively allows any sender to match the SPF policy and defeats the restrictive purpose of SPF.

11. What is SPF PermError?

It is a permanent SPF evaluation error that can occur because of issues such as invalid syntax, multiple SPF records or exceeding SPF processing limits.

12. What is the SPF DNS lookup limit?

SPF limits DNS-query-causing terms during evaluation to prevent excessive DNS processing. Complex nested configurations can exceed the permitted limit.

13. Do nested SPF includes count?

They can. An include: can trigger additional SPF processing and further DNS lookups.

14. Can I simply merge two SPF records?

Not blindly. First verify that every service referenced by both records is legitimate and still required.

15. Can I delete an unknown SPF include?

Investigate it first. It may belong to an application, website, CRM, mail gateway or other legitimate sender.

16. Why does nslookup say "Non-authoritative answer"?

It usually means your DNS resolver supplied the response rather than the domain's authoritative DNS server. It does not by itself indicate an SPF problem.

17. Can I use Google DNS to check SPF?

Yes:

nslookup -type=TXT examplecompany.com 8.8.8.8

18. Can I use Cloudflare DNS?

Yes:

nslookup -type=TXT examplecompany.com 1.1.1.1

19. Why do different DNS servers sometimes show different SPF records?

DNS caching and TTL can temporarily cause different resolvers to return different versions after a recent DNS change.

20. Does a valid SPF record guarantee email delivery?

No. Email delivery depends on many factors, including DKIM, DMARC, IP/domain reputation, message content, sending behavior and recipient filtering.

21. Does SPF stop all spoofing?

No. SPF is one component of email authentication. DKIM and DMARC should also be considered.

22. Should I configure DKIM along with SPF?

Yes. DKIM provides cryptographic email authentication and complements SPF.

23. Should DMARC also be configured?

Generally, yes. DMARC adds alignment, policy and reporting capabilities on top of SPF and DKIM.

24. Can a website server require SPF authorization?

Yes, if it sends email directly using your domain in a way that requires SPF authorization. If it submits mail through an already authorized service, the requirements may differ.

25. How often should SPF be audited?

It is good practice to review SPF whenever email infrastructure changes and periodically as part of a broader DNS and email-security audit.

 

#SPF #SPFRecord #SenderPolicyFramework #EmailSecurity #EmailAuthentication #DNS #DNSRecords #TXTRecord #DNSManagement #DNSConfiguration #SPFCheck #SPFChecker #SPFTroubleshooting #SPFError #SPFPermError #DuplicateSPF #MultipleSPFRecords #EmailDeliverability #EmailProtection #EmailSpoofing #AntiSpoofing #DomainSecurity #CyberSecurity #ITSecurity #NetworkSecurity #GoogleWorkspace #Microsoft365 #Office365 #DKIM #DMARC #SPFDKIMDMARC #DMARCPolicy #DNSLookup #NSLookup #PowerShell #WindowsAdmin #SystemAdministrator #ITAdministrator #ITSupport #TechnicalSupport #EmailAdmin #MailServer #MailSecurity #DNSAudit #SecurityAudit #EmailTroubleshooting #DomainAuthentication #EmailDNS #TechSupport #ITKnowledgeBase