How to merge SPF records?

If you’re using GetResponse alongside other email services (such as a corporate email provider), you might need to add more than one authorized sender to your domain’s SPF record.

However, your domain can have only one SPF record in its DNS zone.
If more than one SPF TXT record exists, SPF validation will fail and messages may not pass authentication checks.

If you need to authorize multiple services (e.g., GetResponse and your business email provider), you must combine all SPF mechanisms into a single record.

Understanding SPF record mechanisms

Let’s walk through how this works using an example where your domain already sends emails through Google Workspace and has the following SPF record in place:

v=spf1 include:_spf.google.com ~all

Now you want to authenticate your domain for sending campaigns via GetResponse, which requires adding another record:

v=spf1 mx a include:_spf.getresponse.com -all

Since you cannot add a second SPF record, you must merge them.

To understand how, let’s break down the components of an SPF record:

• Every SPF record starts with: v=spf1 prefix.
  This identifies the TXT entry as an SPF record (version 1). Although you can have multiple TXT records in DNS, only one can contain v=spf1.
• The a mechanism by itself uses the A record (IP address) of the current domain. If you write a domain or hostname after it (like a:domain.com), it will use the A record (IP address) of that specific domain instead. This allows you to change the IP address in DNS without changing your SPF record. SPF will automatically use the updated IP address.
• The mx mechanism authorizes the mail servers listed in your domain’s MX records.
  If your domain sends emails through its own mailbox server, this mechanism ensures those messages pass SPF.
• The include mechanism (eg: include:_spf.getresponse.com) allows another domain’s SPF policy to be incorporated into yours. In practical terms, when you add: include:_spf.getresponse.com, you are allowing all the sending IP addresses that are listed in _spf.getresponse.com. Similarly: include:_spf.google.com allows the IP addresses that Google has listed in its SPF record.
• The all mechanism: the SPF record must end with an all qualifier. It defines what should happen if a message does not match any authorized source. There are four available qualifiers:
  • +all (not recommended, default, rarely used explicitly)
  • ?all – neutral (not recommended)
  • -all – hard fail (not recommended, unauthorized emails are rejected)
  • ~all – soft fail (recommended, unauthorized emails are accepted but flagged)
    Only one all statement can appear in an SPF record, and it must be at the end.

How to merge SPF records

Existing record (Google Workspace):

v=spf1 include:_spf.google.com ~all

Required GetResponse record

v=spf1 mx a include:_spf.getresponse.com -all

Here’s what you need to do to combine them:

1. Keep the version prefix.
   
   v=spf1
   
   
2. Add all required mechanisms (without duplication).
   If one of your records contains a or mx, keep them. If both records contain them, include them only once.
   
   v=spf1 mx a
   
   
3. Add the new include statement for GetResponse and keep include statement for existing record.
   
   v=spf1 mx a include:_spf.google.com include:_spf.getresponse.com
   
   
4. Add a single all mechanism. We strongly recommend using ~all.
   
   v=spf1 mx a include:_spf.google.com include:_spf.getresponse.com ~all

   

And here’s the final record you want to replace your current record with:

v=spf1 mx a include:_spf.google.com include:_spf.getresponse.com ~all

Key rules to remember

• Only one SPF record per domain
• Only one v=spf1
• Only one all mechanism
• Do not duplicate a, or mx entries
• Always verify your updated SPF record after DNS propagation

Properly merging SPF records ensures your emails sent via GetResponse and other services pass authentication checks, helping maintain deliverability and sender reputation.