One SPF record for several mail services (and the 10-lookup limit)

SPF lists the servers allowed to send email for your domain. Businesses often send from several places: cPanel mailboxes, the website, a newsletter tool, a CRM and a helpdesk. Each service tells you to "add our SPF record", and adding them as separate records breaks SPF completely. This guide shows how to merge them correctly.

Before you start

• List every service that sends email with your domain in the From address.
• Find each one's SPF instruction, usually an include: value such as include:_spf.google.com.
• Open cPanel → Domains → Zone Editor → Manage and filter for TXT records starting with v=spf1. Basic setup is in SPF, DKIM and DMARC in cPanel.

The golden rule: only one SPF record

A domain must have exactly one TXT record that starts with v=spf1. Two records cause a PermError, and receivers treat SPF as failed for every message. Merge all mechanisms into a single record.

Build the merged record

Structure: v=spf1, then all mechanisms, then exactly one ending (~all or -all).

Example for cPanel website mail plus Microsoft 365 and a newsletter service:

v=spf1 +a +mx include:spf.protection.outlook.com include:servers.newsletter-provider.example ~all

Edit the existing record in Zone Editor, replace its value with the merged one and click Save Record.

The 10 DNS lookup limit

Receivers may perform at most 10 DNS lookups while evaluating SPF. Each include, a, mx, exists and redirect counts, including lookups nested inside the includes. Large providers' includes use several lookups each, so four or five services can exceed the limit and cause a PermError.

• Remove services you no longer use.
• Replace +a +mx with ip4:203.0.113.10 (your server IP from cPanel General Information); ip4 and ip6 cost no lookups.
• Send bulk mail from a subdomain (e.g. news.example.com) with its own SPF record, which has its own 10-lookup budget.
• Check the count with an online SPF checker after every change.

~all or -all?

~all (softfail) asks receivers to accept but mark unlisted senders; -all (fail) asks them to reject. Start with ~all, and enforce with DMARC instead; see DMARC reports and policies.

Troubleshooting

• PermError: multiple SPF records: delete the extra v=spf1 records after merging.
• PermError: too many DNS lookups: reduce includes as above.
• Website mail fails SPF after switching to Google or Microsoft: you removed +a +mx or the server IP.

Next steps

• Google Workspace records
• Microsoft 365 records