Multiple SPF Records: Google Workspace vs Microsoft 365 for Managing SPF Email Authentication

Use one SPF record per domain, not two. If you send mail from both Google Workspace and Microsoft 365, merge them into one clean TXT record.

TLDR: Multiple SPF records break SPF checks. A domain should have one SPF TXT record, like v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all. In a 50 user company, one bad extra SPF record can push valid invoices into spam for 10% to 20% of customers. Fixing it often takes five minutes, but finding it can waste half a day.

The short version: SPF is picky

SPF is like a guest list for your domain.

It tells receiving mail servers which services may send email for you. Google Workspace may be on the list. Microsoft 365 may be on the list. Your CRM, billing tool, newsletter app, and help desk may be there too.

But SPF has one very annoying rule.

You can only have one SPF record for a domain.

Not one for Google. Not one for Microsoft. Not one “just in case.” One total.

If your DNS has two records like these, you have a problem:

• v=spf1 include:_spf.google.com ~all
• v=spf1 include:spf.protection.outlook.com ~all

That does not mean “both are allowed.” It means “error.” Many servers return SPF PermError. That sounds fancy. It means the mail server looked at your SPF setup and said, “Nope.”

Google Workspace SPF vs Microsoft 365 SPF

Google Workspace uses this include:

include:_spf.google.com

Microsoft 365 uses this include:

include:spf.protection.outlook.com

They are both normal. They are both correct. The mess starts when people add them as separate TXT records.

If you use both services, combine them:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

That says:

• Google can send mail for this domain.
• Microsoft 365 can send mail for this domain.
• Other senders are suspicious.

Simple. Clean. Less drama.

Why would anyone use both Google and Microsoft?

It happens more than you think.

A company may use Google Workspace for Gmail. Then the sales team uses Microsoft 365 for Outlook and Teams. Or a business is moving from Google to Microsoft. During the move, both systems send email.

Sometimes the reason is less neat.

The owner likes Gmail. Finance likes Outlook. Marketing uses a third party platform. The old IT person left three years ago. DNS now looks like a junk drawer.

Honestly, it feels like old SPF records multiply when nobody is watching.

A quick user case

Meet “Bright Bean Studio.” It has 42 employees.

They use Google Workspace for everyday email. They also use Microsoft 365 because one client requires shared Outlook calendars. On top of that, Mailchimp sends newsletters.

Their DNS had three SPF records:

• One for Google.
• One for Microsoft.
• One for Mailchimp.

For two months, 18% of their proposal emails landed in spam at large companies. Sales blamed bad timing. Marketing blamed subject lines. The real villain was DNS.

The fix was one merged SPF record:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net ~all

Within a week, spam folder complaints dropped. Not magic. Just less broken authentication.

The “one SPF record” rule

Here is the rule again, because it saves pain:

One domain gets one SPF TXT record.

This record usually starts with:

v=spf1

Then it lists approved senders. It ends with an instruction like:

• ~all means “soft fail.” Be cautious with other senders.
• -all means “hard fail.” Reject other senders.
• ?all means “neutral.” Not very useful.

Most companies start with ~all. Once they know every sender is listed, they may move to -all.

Do not rush that change. Locking the door is great. Locking your own team outside is less great.

Image not found in postmeta

Google Workspace setup: what to expect

Google keeps SPF fairly simple.

For normal Google Workspace mail, the basic record is:

v=spf1 include:_spf.google.com ~all

You add it in your DNS host. Not inside Gmail. Not usually inside the Google Admin console. Google Admin may show guidance, but the real change happens where your domain DNS lives.

That may be GoDaddy, Cloudflare, Namecheap, Squarespace, or another provider.

Common Google SPF mistakes include:

• Adding a second SPF record instead of editing the old one.
• Using quotes incorrectly in DNS panels that add quotes for you.
• Forgetting a newsletter tool.
• Editing the wrong domain.

It drives me crazy that some DNS screens hide TXT records behind extra clicks. Expect to spend 30 seconds finding the right box and five minutes asking why the save button is grey.

Microsoft 365 setup: what to expect

Microsoft 365 uses this common SPF include:

v=spf1 include:spf.protection.outlook.com ~all

Microsoft may also show SPF guidance during domain setup. It is usually clear enough. The problem starts when Microsoft sees no SPF and tells you to add one, while your domain already has a Google SPF record.

If that happens, do not create a second record.

Edit the existing one.

So this:

v=spf1 include:_spf.google.com ~all

Becomes this:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Done.

What about the 10 lookup limit?

SPF has another fussy rule.

Your SPF record can trigger no more than 10 DNS lookups.

Includes count. Redirects count. Some “a” and “mx” mechanisms count too.

Google and Microsoft each use lookups behind the scenes. Add a CRM, a help desk, a billing platform, and two marketing tools, and you may hit the limit.

When that happens, SPF can fail even if the record looks fine.

Signs of this issue include:

• SPF passes for some senders but fails for others.
• Testing tools mention “too many DNS lookups.”
• Mail delivery gets weird after adding a new platform.

The fix may be to remove old senders. You can also use SPF flattening, but be careful. Flattening changes includes into IP addresses. Those IPs can change. If the tool does not keep them fresh, your email can break later.

Best SPF record for Google plus Microsoft

For a domain that sends from both Google Workspace and Microsoft 365, a common starting record is:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

If you also use a sending service, add its include too.

Example:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:mail.zendesk.com ~all

But only add services that really send email using your domain.

Do not add random includes because a help article mentioned them. SPF is not a sticker collection.

Image not found in postmeta

SPF is not enough by itself

SPF helps. But it is not the whole security stack.

You should also use:

• DKIM: Adds a digital signature to messages.
• DMARC: Tells receivers what to do when SPF or DKIM fails.
• DMARC reports: Show who is sending as your domain.

SPF checks the sending server. DKIM checks the message signature. DMARC ties the results to your visible From address.

That trio is much stronger than SPF alone.

Simple cleanup checklist

Use this quick checklist before changing anything:

1. Open your DNS manager.
2. Find all TXT records that start with v=spf1.
3. If there is more than one, merge them.
4. Keep only one final SPF record.
5. Add Google if you send from Google Workspace.
6. Add Microsoft if you send from Microsoft 365.
7. Add only real third party senders.
8. Test the domain with an SPF checker.
9. Watch DMARC reports for a week.

The bottom line

Google Workspace and Microsoft 365 do not need to fight. SPF just needs one tidy list.

If your domain sends from both, merge both includes into one record. Remove duplicates. Watch the lookup count. Then add DKIM and DMARC so your email has backup.

Email authentication sounds dry. But the payoff is very real. Fewer spam folder surprises. Fewer angry clients. Fewer “did you get my email?” messages.

And that alone is worth cleaning up one tiny TXT record.