How to Fix Duplicate Netblocks in an SPF Record for Microsoft 365
Question details
The user needs to resolve duplicate netblocks reported by DMARCian in an SPF record that includes multiple email services like Microsoft 365, Zendesk, and Pardot.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Managing domain DNS and email authentication settings to prevent email delivery failure.
- Observed behavior
- DMARCian identifies duplicate netblocks in the domain's SPF record, raising concerns about hitting the 10 DNS lookup limit and whether specific includes can be safely removed.
Before modifying your DNS settings, copy and back up your current SPF record as a text file. Verify you have a complete list of all authorized third-party services that send email on behalf of your domain.
Safely Consolidate SPF Includes and Remove Duplicates
Carefully review and flatten your SPF record to resolve duplicate netblocks without arbitrarily removing essential includes like Microsoft 365.
Duplicate netblocks usually occur when multiple third-party email providers route through the same underlying infrastructure. While cleaning up duplicates helps avoid exceeding the SPF 10-lookup limit, removing core includes can disrupt your organization's email delivery.
Log in to your domain registrar or DNS hosting provider's control panel and navigate to the DNS Management or Advanced DNS settings area.
Find your current TXT record that begins with 'v=spf1'. Copy this record into a text editor for safe editing.
Use a tool like DMARCian to identify exactly which IP ranges (netblocks) are overlapping between Microsoft 365, Zendesk, and Pardot.
Remove redundant direct IP network declarations (e.g., duplicate ip4: or ip6: mechanisms). Do not remove the base 'include:spf.protection.outlook.com' mechanism unless you are replacing it with a flattened list of IPs specifically provided by your administrator.
Save the updated TXT record in your DNS console. Run an SPF lookup tool to ensure the syntax is valid and you remain under the 10 DNS lookup limit.
Looking for a Cost-Effective Alternative to Microsoft 365?
While you manage your organization's complex DNS and email routing settings, providing powerful desktop productivity software doesn't have to be complicated or expensive. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office for your team's document creation needs.
Frequently Asked Questions
What happens if my SPF record exceeds the 10 DNS lookup limit?
If your SPF record requires more than 10 DNS lookups to fully resolve, recipient email servers may fail the SPF check automatically. This will cause your legitimate emails to be marked as spam, quarantined, or rejected entirely.
Can I manually flatten my SPF record to fix duplicates?
Yes, you can manually replace multiple 'include' statements with their direct IPv4 or IPv6 addresses (flattening). However, you must regularly monitor and update these IPs if the service providers (like Microsoft or Zendesk) change their network infrastructure.
How long does it take for SPF record changes to take effect?
DNS changes typically take anywhere from 15 minutes to 48 hours to propagate across the internet. The exact time depends on the Time to Live (TTL) value set on your previous TXT record.
Should I remove the Microsoft 365 include if Zendesk already covers the same IP?
No. You should not remove the Microsoft 365 SPF include (spf.protection.outlook.com) solely because of a duplicate netblock report. Removing it may break email delivery for users sending directly from Outlook or Exchange Online if Microsoft routes mail through different IPs in that block.
