Combine SPF records instead of publishing a second policy.

Why duplicate SPF records fail

SPF receivers evaluate one policy for a domain. Publishing two TXT records that both begin with v=spf1 creates an invalid multiple-record result instead of combining their permissions.

EmailDesk checks public DNS for exactly one SPF policy when a supported gateway requires an include. If multiple policies are returned, sending is blocked until they are merged.

Inventory every legitimate sender

Before editing the policy, identify every service that sends using the domain's envelope identity. This may include a current mailbox provider, EmailDesk, a CRM, a billing platform, and a support tool.

Remove a mechanism only after its owner confirms that the service no longer sends. An SPF cleanup can otherwise stop valid business mail.

• Copy the complete current SPF record.
• Map each include, ip4, ip6, a, or mx mechanism to an active sender.
• Confirm whether the selected EmailDesk gateway is MailChannels or another configured provider.
• Keep the final policy qualifier, such as ~all, at the end.

Merge the mechanisms into one policy

For a domain that already uses Google Workspace and will also send through the EmailDesk MailChannels gateway, retain Google's include and add MailChannels before the final qualifier.

v=spf1 include:_spf.google.com include:relay.mailchannels.net ~all

• Use one continuous SPF value.
• Do not add a second v=spf1 TXT record.
• Do not place mechanisms after the all mechanism.
• Review the SPF DNS-lookup limit when many includes are present; flattening or removing providers without analysis can create different failures.

Publish, propagate, and recheck

Replace the old SPF TXT value at the authoritative DNS provider with the merged value. Do not delete unrelated TXT records such as domain verification or DMARC.

After the TTL and propagation window, confirm that public DNS returns one SPF policy and run the EmailDesk sending-domain check again.

• Check more than one public resolver if results appear inconsistent.
• Confirm the required include is present exactly as issued.
• Send a controlled test only after EmailDesk reports the gateway SPF requirement as passed.

Understand what SPF does not guarantee

SPF authorizes sending infrastructure for an envelope domain. It does not encrypt email, verify message content, prove recipient consent, or guarantee provider acceptance or inbox delivery.

SPF can also break when mail is forwarded unless DKIM and aligned DMARC provide another valid authentication path. Keep DKIM and DMARC in the domain plan rather than treating SPF as a complete solution.