nanoPost

The WordPress Email Authority

SPF Record Merger for WordPress Email

An SPF record tells receivers which servers are allowed to send mail on behalf of a domain. Every WordPress site that sends email through more than one provider ends up combining include: mechanisms in the same TXT record. Add a mailer plugin here, a marketing service there, a form host on the side, and the record grows. Past a certain point it breaks in a way most site owners never see.

RFC 7208 caps a single SPF evaluation at ten DNS lookups. Each include:, a, mx, exists:, or redirect= counts. Cross that ceiling and receivers return PermError; most treat the message as if there were no SPF at all, and Gmail, Yahoo, and Microsoft 365’s bulk-sender scorecards mark the domain as failing. Paste the current record, pick the providers actually in use, and this tool returns a merged, deduplicated record with the running lookup count on the badge.

Paste the whole record, or leave blank to build one from scratch. Look it up with dig +short TXT yourdomain.com or on any DNS lookup site.

Hold Ctrl (or ⌘) to pick more than one. Each provider adds an include: mechanism.

Picking a plugin here prefills the providers it supports. Handy if you know your plugin but not which provider include is in your SPF.

Lookups counted per RFC 7208 §4.6.4 (a, mx, include:, exists:, redirect=, ptr). ip4:, ip6:, and all don’t count. Receivers hitting the limit return PermError, and most treat the message as if there were no SPF at all — so staying under 10 matters.

How the merge works

  • Existing record parsed first. Mechanisms come out in the order they appeared; the all qualifier is preserved (-all, ~all, ?all). Paste raw dig +short TXT output with the split quoted strings and it’s normalised the same way a resolver would assemble it.
  • Provider includes appended. Every provider carries a canonical spf_includes list in the providers.json dataset. SendGrid contributes sendgrid.net, Mailgun contributes mailgun.org, Zoho Mail contributes both zoho.com and zohomail.com, and so on. Pick a WP mailer plugin and the tool prefills the provider multiselect with the providers that plugin supports.
  • Duplicates dropped. If the existing record and a provider selection both point to the same include:, only one copy survives. The dropped entries are listed under the merged record so nothing is silent.
  • Lookup count enforced. The badge counts the surviving mechanisms that trigger a DNS lookup (include:, a, mx, exists:, redirect=, ptr). It turns amber at eight and red at eleven. ip4:, ip6:, and all never count against the budget.

When a merge won’t save the record

Deduplication buys back one or two lookups, sometimes three. It cannot turn a fifteen-provider record into a compliant one. If the merged output shows twelve or thirteen lookups, the answer is not a cleverer SPF, it’s fewer senders on the same domain. Split marketing off to a subdomain (news.example.com) with its own SPF, keep transactional on the root, and each record stays under the ceiling on its own. That’s the same architectural move Microsoft 365, Google Workspace, and every large sender uses internally, and it’s the only durable answer once a domain is genuinely wired to more than eight or nine services.

Related tools

When you’re ready to check what a receiver actually sees for a domain, the DNS Auth Checker resolves SPF, DKIM, DMARC, and MX live and scores the domain against Gmail, Yahoo, and Microsoft 365’s bulk-sender requirements. If the merge here turned up a provider that no longer belongs, the free-tier comparator is the fast way to pick the one provider a small WordPress site actually needs, and the SMTP cost calculator is the next step above the free tiers.