All fixes

Merge duplicate SPF records

spf-multiple-records

Two SPF records is a permanent error, so receivers ignore both and your domain ends up unprotected. Merge them into a single TXT record.

Why this matters

Multiple SPF records cancel each other out, effectively removing sender restrictions. Enables phishing via spoofing but is not direct system exploitation.

Cloudflare

  1. 1 Go to DNS > Records
  2. 2 Find all TXT records starting with v=spf1
  3. 3 Delete all but one, then merge the include: directives into the remaining record
# WRONG: two separate SPF records
v=spf1 include:_spf.google.com ~all
v=spf1 include:amazonses.com ~all

# RIGHT: one merged record
v=spf1 include:_spf.google.com include:amazonses.com -all
Cloudflare docs

Does your app still have this?

Scan your domain