mailgun domain verification failed multiple spf records

mailgun domain verification failed multiple spf records

TL;DR

SPF allows exactly one TXT record starting with v=spf1, and Mailgun's verifier fails the domain while two exist. List all TXT records, merge every SPF mechanism into one record including Mailgun's include, delete the extras, wait for propagation, and re-run verification.

mailgun domain verification failed multiple spf records

Use this when

• Mailgun domain verification fails and the domain has two or more SPF records
• SPF worked before another service's record was added
• Receivers report permerror on SPF checks

Not for this skill when

• DKIM record verification failing (separate record, separate fix)
• A single SPF record with a syntax error (fix the syntax)
• Mailgun tracking or webhook issues (unrelated to DNS)

Steps

Step 1: List all TXT records

Query the domain's TXT records and identify every one starting with v=spf1. Expected: you see the full set of competing SPF records.

Step 2: Merge into one record

Combine all mechanisms and includes, including Mailgun's, into a single v=spf1 record. Expected: one record covers every legitimate sender.

Step 3: Delete the extras

Remove the duplicate SPF TXT records so exactly one remains. Expected: the domain publishes a single SPF record.

Step 4: Wait for propagation

Wait out the TTL and confirm with public resolvers. Expected: one SPF record visible everywhere.

Step 5: Re-run Mailgun verification

Verify the domain in Mailgun again. Expected: SPF verification passes.

Tool compatibility

Mailgun domain verification; DNS TXT records; SPF (RFC 7208).

Variant phrasings

Variant 1

mailgun multiple spf records verification failed

Variant 2

more than one spf record mailgun

Variant 3

merge spf records mailgun include

Why it happens

The SPF specification is unambiguous: a domain must publish exactly one SPF record, and evaluators return permerror when they find more. The duplicates accumulate innocently, each SaaS vendor's onboarding docs say to add their SPF record, and nobody mentions the single-record rule until verification fails. Mailgun's verifier enforces the rule strictly, so the domain fails even though each individual record is valid. Merging is mechanical but needs care: every legitimate sender's mechanism must survive the merge, and the 10-DNS-lookup limit means includes must be counted, not just concatenated.

Edge cases / pitfalls

• Count DNS lookups after merging; more than 10 mechanisms that trigger lookups breaks evaluation.
• The all mechanism should appear once at the end; duplicated or conflicting endings cause failures.
• SPF flattening services exist for complex cases, but audit what they include before trusting them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UXlRsmI63XNJYMLndzgd4A