MX, SPF, and TXT together

An MX record tells the internet where mail for your domain should be delivered. SPF is a TXT record that lists which servers may send mail using your domain name. Those two jobs are separate, and they only work when both match how you actually receive and send mail.

What each record is for

MX handles inbound mail. The names in your MX records must point at the systems that should accept messages for your domain. SPF handles outbound trust. Receiving servers check your SPF TXT string to decide whether a message claiming to be from you came from an approved host.

Priority values such as 10 and 20 are enough for most setups. List the primary mail host with the lower number first. You do not need exotic priority schemes unless a provider specifically requires them.

dig example.com MX +short
dig example.com TXT +short

Your MX answer should show the hosts you truly want to receive on. Your TXT answer should include one SPF string that starts with v=spf1 and ends with -all or ~all. That single string needs to name every sender you use, such as the hosting server, Google, a ticket system, or a newsletter service.

Keep one SPF record, and place DKIM and DMARC beside it

Two SPF TXT records at the apex create a permanent error. Publish only one SPF string and put every approved sender inside it. DKIM is a separate TXT record on a selector hostname, not a second SPF entry. DMARC is a TXT record at _dmarc.example.com that tells receivers what to do when SPF or DKIM checks fail.

None of those TXT records replaces MX. If Google Workspace is your MX target and you also send through Google, SPF must include Google’s senders. If the server or a smarthost sends mail for you, SPF must name that path as well. Draw the send and receive paths first, then publish one SPF record, the DKIM selector your vendor gave you, and a DMARC policy you are ready to enforce.

How to avoid the “mail is down” mix-ups

People often copy MX from one vendor and SPF from another without checking both sides. Two MX providers “for backup” only help if both paths are real and your SPF covers the hosts that actually send bounces or outbound mail. cPanel’s Email Deliverability screen can show missing SPF or DKIM for mail that leaves this server. It will not know about outside tools such as Mailchimp, so add those include: values by hand. Do not let two panels each write their own SPF record.

If dig against a public resolver still shows old mail hosts after you edit the zone, the problem may be nameservers or glue rather than the MX line itself. See nameserver change vs glue when the published zone never seems to update.