Confirm the exact failure

Query TXT at the domain used by the message’s SMTP MailFrom, not automatically at the visible From domain. Identify records whose first term is v=spf1. RFC 7208 requires evaluation to return a permanent error when multiple SPF records are selected. Two strings within one DNS TXT record are different from two separate SPF records, so inspect the DNS provider’s record model as well as rendered command output.

Do not delete other TXT records. Site verification tokens, DKIM keys, and unrelated declarations can legally share a name; only the competing SPF policies must be consolidated.

Inventory before merging

For each mechanism in both policies, identify the service and owner. For example:

v=spf1 include:_spf.provider-a.example -all
v=spf1 ip4:192.0.2.40 include:_spf.provider-b.example ~all

This is illustrative syntax using reserved names and addresses. Do not paste it into production. Confirm whether provider A, provider B, and 192.0.2.40 still send for this exact MailFrom domain. Unknown entries should be investigated, not preserved forever and not removed on sight.

Build one reviewed policy

After confirming legitimate sources, construct one candidate with a single v=spf1 version term and one terminating policy. Mechanism order matters because evaluation stops on the first match. Check the expanded dependencies and SPF’s processing limits; simply concatenating records can produce a policy that still returns permerror.

Record the current DNS values, candidate, TTL, approver, expected result, and rollback. If a provider gives a required include, use its current official documentation and exact host. Avoid “flattening” dynamic provider ranges into copied IPs unless you own a process that safely tracks changes and understands the operational tradeoff.

Publish and verify

Replace the competing SPF records with the single candidate while preserving unrelated TXT records. Query an authoritative server, then the recursive resolver used by your test. Send a fresh message through every retained service and inspect trusted receiver results for the actual SPF identity.

Also test a source that should not be authorized if you have a safe controlled method. The fix is complete when one SPF policy is selected, legitimate streams still pass as intended, unauthorized sources are not accidentally included, and the inventory explains every term. A green syntax check by itself cannot prove that the policy represents the organization’s real senders.