Google Workspace SPF Problems
An SPF record lists which mail servers are authorized to send email on behalf of your domain. Problems usually arise when the record does not account for every system that actually sends mail for you, or when there is more than one SPF record.
Common Causes
- Multiple SPF TXT records at the same domain - SPF only allows one, and having two invalidates both.
- The record missing "include:_spf.google.com", which is required for Workspace mail to pass SPF.
- Other sending services (like a CRM, marketing platform, or invoicing tool) not included in the record.
- Exceeding SPF's 10 DNS lookup limit by including too many third-party services.
- A record left over from a previous provider that was never removed.
Safe Troubleshooting Steps
- Look up your domain's current SPF TXT record and confirm there is only one.
- Confirm it includes "include:_spf.google.com" for Workspace mail.
- List every other service that sends mail as your domain (marketing tools, invoicing, CRMs) and confirm each is included.
- Count DNS lookups triggered by "include" mechanisms to stay under SPF's 10-lookup limit.
- Remove any outdated includes from services you no longer use.
What Our Support Can Cover
- Auditing your current SPF record for duplicates or errors
- Identifying which sending services need to be included
- Checking against the 10-lookup limit
- Providing a corrected SPF record value
Frequently Asked Questions
What happens if I have two SPF records?
Having more than one SPF TXT record makes SPF invalid for the whole domain, which can cause otherwise legitimate mail to fail authentication.
Does SPF alone guarantee delivery?
No. SPF is one signal receiving servers use among several. Correct SPF, DKIM and DMARC together give your mail the best chance of consistent delivery, but no combination guarantees it.