Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the usual Google Apps SPF record in my DNS:

v=spf1 ~all

and now, since we are using ZenDesk, I should also add:

v=spf1 ~all

Should they be merged into one like this:

v=spf1 ~all
share|improve this question
up vote 4 down vote accepted

Yes, that is correct, unless includes a redirect (which it doesn't). In that case, should be moved to end of the list to avoid replacing all entries after the include with the redirect

Also, be aware that the RFC (IETF RFC4408) specifies that a maximum of 10 MX or PTR lookups should be allowed, after which, validation of a single record should be terminated. This is to ensure that an SPF parser doesn't get trapped in an endless lookup scenario (potential DoS'ing).

How does this apply in real life?
Let's say that both includes uses the "mx" mechanism, and that each has 6 distinct MX records. Now, when the first include ( has been processed, you only have 4 lookups left, so to speak. If the MTA that is being validated is on of the last 2 distinct MX records for the second include (, the validation might actually fail even though you've include all the records correctly.

This is not the case for the above scenario, but it's worth taking into account, since not all companies think about this when designing their SPF structure. Just try to lookup, say, TXT for and try to count the number of lookups that might result in ;-)

share|improve this answer

Yes, that will work. It's also the proper way to do it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.