← The duplicate DNS mistake that can kill your outbound emails

Share

During a weekend security audit of our sending domains with Zuri, I noticed something odd in our TXT records that looked entirely harmless at first glance.

We had two separate, perfectly valid SPF records sitting on the same root domain.

Both started with v=spf1. One was set up years ago for Zoho Mail; the other was added later for Brevo marketing sends. Each record worked fine on its own. But together, they triggered a permerror — not a fail or a soft fail, but a permanent error that fails without warning you.

RFC 7208, the specification that governs SPF, is explicit: a domain must not have more than one SPF record. Receiving mail servers do not try to merge them or pick the “better” one. They return permerror, stop evaluating your SPF, and if your DMARC is set up, your email is silently tossed into the spam bin. No bounce. No error message. No notification.

In this case, the records were:

v=spf1 include:zcsend.net ~all
v=spf1 include:zoho.com include:sender.zohobooks.com include:spf.sendinblue.com mx ~all

Two separate senders. Two separate records. Neither wrong on its own. Together, broken.

How does this slip into production?

Usually, it happens through accumulation. Someone sets up Zoho Mail and adds an SPF record. A year later, someone else sets up Brevo for marketing emails and adds another one. Neither person knew the first record existed. The domain slips into a broken state that no one notices because delivery mostly still works — email delivery is messy enough that messages often get through anyway, which hides the problem.

The fix is simple: delete both and create one merged record.

v=spf1 include:zoho.com include:sender.zohobooks.com include:spf.sendinblue.com include:zcsend.net mx ~all

One record. All senders included. ~all to softfail anything that does not match.

Five minutes to fix. Potentially years of silent degraded deliverability before it gets caught.

Check yours

dig +short TXT yourdomain.com | grep spf

If that returns more than one line, you have a problem. Most domains I look at have either no DMARC, a p=none that was set up and forgotten, or this duplicate SPF issue. All three are fixable in under an hour, but none of them announce themselves.