Email errors

SPF permerror: why SPF evaluation failed and how to fix it

What an SPF permerror means, the causes RFC 7208 names, how to find which one hit your record, how to fix it, and what it means for DMARC.

By Updated Last verified

On this page
  1. What an SPF permerror means
  2. What causes a permerror
  3. A syntax error in the record
  4. More than 10 DNS-querying terms
  5. Too many void lookups
  6. More than one SPF record
  7. An include or redirect that finds no SPF record
  8. How to find which cause applies
  9. How to fix it
  10. What receivers do with a permerror
  11. What a permerror means for DMARC
  12. Check your record
  13. Sources

An SPF permerror means the receiving server could not correctly interpret your domain's published SPF records, and fixing it needs a change by whoever runs your DNS (RFC 7208 section 2.6.7 (opens in a new tab)). Among the causes the standard names are a syntax error (opens in a new tab), more than 10 terms that need DNS lookups or too many lookups that find nothing (section 4.6.4 (opens in a new tab)), more than one SPF record (opens in a new tab), and an include (opens in a new tab) or redirect (opens in a new tab) that points to a domain with no SPF record. Find which one applies to your record, fix the record, and check it again.

What an SPF permerror means

Sender Policy Framework (SPF) (opens in a new tab) lets a domain publish, in the Domain Name System (DNS) (opens in a new tab), which hosts may use its name, and receivers test the sending server against that list.

A permerror is one of the results that test can return. It means the domain's published records could not be correctly interpreted, and resolving it definitely needs action by whoever runs the domain's DNS (RFC 7208 section 2.6.7 (opens in a new tab)). That sets it apart from a temperror: a transient error, usually in DNS, where a later retry may succeed without any DNS change (section 2.6.6 (opens in a new tab)).

Receivers are recommended to record the SPF result in the message header (section 9 (opens in a new tab)). In the Received-SPF header field the result can be permerror, alongside results such as fail, and the field's key-value list can include a problem key with details about the error (section 9.1 (opens in a new tab)).

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

What causes a permerror

A syntax error in the record

The syntax of the whole record is checked first. A syntax error anywhere in it ends evaluation at once with a permerror, before anything else is interpreted (RFC 7208 section 4.6 (opens in a new tab)).

Not every typo is a syntax error, though. Microsoft's SPF guide (opens in a new tab) lists formatting mistakes that it says make SPF validation fail. Under RFC 7208 they end differently:

Mistake (on example.com) Microsoft's description What RFC 7208 makes of it
include:_spf.example.com. Trailing period after the domain name Not a syntax error: the grammar lets a domain name end in a dot (section 7.1 (opens in a new tab)).
include=_spf.example.com Equal sign instead of colon after include Not a syntax error: a term with = right after its name is a modifier (section 4.6.1 (opens in a new tab)), include is not a modifier RFC 7208 defines, and unrecognized modifiers must be ignored (section 6 (opens in a new tab)). The record is evaluated without that include.
include: _spf.example.com Space between the colon and the domain name A syntax error, so a permerror: include must be followed by : and a domain (section 5.2 (opens in a new tab)), and the leftover _spf.example.com is read as a mechanism but is not one of the defined mechanisms.

The redirect and exp modifiers may each appear only once in a record; a second one gives a permerror (section 6).

If your DNS host stores a long record as several strings, receivers treat them as one string joined with no spaces added (section 3.3 (opens in a new tab)).

More than 10 DNS-querying terms

The include, a, mx, ptr and exists mechanisms and the redirect modifier cause DNS queries. SPF implementations must limit them to 10 per evaluation, and past that the result is a permerror (section 4.6.4 (opens in a new tab)). Each MX record an mx term finds must also not lead to more than 10 address (A or AAAA) lookups, or that mx term produces a permerror.

Not every message hits the limit. Evaluation stops as soon as the message source is validated, so a record with enough terms for more than 10 lookups can still pass mail from sources matched early, as Microsoft notes. The SPF too many DNS lookups guide covers counting what each term costs and removing or moving the ones you don't need.

Too many void lookups

A void lookup is a term whose DNS query comes back with no answers (RCODE 0 with an answer count of 0) or with a name error (RCODE 3). Implementations should limit void lookups to two. They may make the limit configurable, with two as the recommended default, and going over it produces a permerror (section 4.6.4).

More than one SPF record

Of the records returned for your domain, receivers discard any that do not begin with exactly v=spf1. If more than one remains, the result is a permerror (section 4.5 (opens in a new tab)). Microsoft gives the reason: the receiving system can't determine which record to evaluate. Use only one SPF record per domain or subdomain.

An include or redirect that finds no SPF record

An include evaluates the named domain's SPF record recursively, and its own result depends on that evaluation. If the included domain has no SPF record (a result of none), or its record gives a permerror, the include returns a permerror (section 5.2). Microsoft adds that an include: domain that doesn't resolve also gives a permerror, and that messages might be rejected.

A redirect is followed when no mechanism in the record matched. If its target has no SPF record, or the target name is malformed, the result is a permerror rather than none (section 6.1 (opens in a new tab)).

How to find which cause applies

Work through the record in this order:

  1. Count the SPF records. Look up your domain's records and count those that begin with v=spf1. More than one is a permerror by itself (RFC 7208 section 4.5 (opens in a new tab)).
  2. Read the syntax. Look for the formatting mistakes in Microsoft's list (opens in a new tab) above, and for a second redirect or exp (section 6 (opens in a new tab)).
  3. Follow every include and redirect. Query the DNS TXT record of each domain named in an include: to verify it. A redirect target needs an SPF record too (section 6.1 (opens in a new tab)).
  4. Count the lookups. DemiSignal's SPF lookup counts a domain's DNS lookups against the limit of 10, counted through every included record. RFC 7208 counts include, a, mx, ptr, exists and redirect (section 4.6.4 (opens in a new tab)).

If a receiver added a Received-SPF header field to the message, its problem key can carry details about the error (section 9.1 (opens in a new tab)).

How to fix it

  • A syntax error. Avoid the mistakes Microsoft lists: use a colon rather than an equal sign after include, leave no space between the colon and the domain name, and leave no trailing period after the domain name (Microsoft (opens in a new tab)).
  • Two SPF records. Merge them into one record that lists every service (SPF lookup). A domain must publish exactly one SPF record, so add new services to the one you have instead of creating a second (SPF record generator).
  • An include that no longer resolves. Remove it: DemiSignal's SPF lookup advises removing includes that no longer resolve.
  • A redirect with no SPF record at its target. Point it at a domain that publishes one, since a target without an SPF record gives a permerror (section 6.1 (opens in a new tab)).
  • More than 10 lookups. Follow the SPF too many DNS lookups guide. If you consider flattening, the SPF flattening guide covers when Microsoft says it is reasonable or risky.

To make the change, find the TXT record on the root of your domain that starts with v=spf1 in your DNS provider, and change that record; never keep two. DemiSignal's SPF record generator gives the timing: changes usually show within an hour, and some providers take up to 48 hours. Then run the free check to confirm the record and see the real lookup count.

What receivers do with a permerror

A permerror gives the receiver no true indication of whether the sender is authorized (RFC 7208 appendix G.3 (opens in a new tab)). What to do with the message is often a matter of the receiver's local policy. Rejecting it is an option, and the less intrusive choice is to deliver it, perhaps with an annotation or a log entry about the problem.

A receiver that rejects the message for this reason during the Simple Mail Transfer Protocol (SMTP) (opens in a new tab) transaction should use reply code 550 and, if supported, the enhanced status code 5.5.2 (section 8.7 (opens in a new tab)). If your record uses macros, a permerror can also come from the checked identities having an unexpected format.

Microsoft's SPF guide (opens in a new tab) describes the bounce for a record over 10 lookups: the destination rejects the message in a non-delivery report (NDR) with one of two errors, "The message exceeded the hop count." or "The message required too many lookups."

What a permerror means for DMARC

DMARC (opens in a new tab) (Domain-based Message Authentication, Reporting, and Conformance) needs an SPF or DKIM pass for a domain aligned with the Author Domain, the domain in the message's From header (RFC 9989 section 1 (opens in a new tab)). For SPF, DMARC relies only on the MAIL FROM check, and the domain SPF validates in MAIL FROM is the SPF-authenticated domain (section 4.4.2 (opens in a new tab)). Alignment cannot exist without an SPF pass (appendix B.1.1 (opens in a new tab)), so a message with an SPF permerror cannot align through SPF.

It can still pass through DomainKeys Identified Mail (DKIM) (opens in a new tab). A message passes DMARC if any DKIM-authenticated domain aligns with the Author Domain (section 4.4.1 (opens in a new tab)). If no authenticated domain aligns, it fails the DMARC check (section 5.3.5 (opens in a new tab)). The DMARC fail guide covers fixing SPF and DKIM alignment for services and forwarded mail.

Check your record

DemiSignal's check reads only the public DNS records of the domain you enter, with no account needed. For SPF it flags a missing record and a record that is close to or over the 10 DNS lookup limit. The SPF lookup reads public DNS only, changes nothing and sends no email; it counts the record's lookups against the limit and gives the exact record that fixes what is wrong.

Sources

Tools for this

Frequently asked questions

What does SPF permerror mean?

The receiver could not correctly interpret the domain's published SPF records. Fixing it requires a change by whoever runs the domain's DNS.

What causes an SPF permerror?

A syntax error in the record, more than 10 terms that need DNS lookups, more void lookups than the receiver allows (two by default), more than one SPF record, or an include or redirect that points to a domain with no SPF record.

Does an SPF permerror make DMARC fail?

Not on its own. Without an SPF pass, SPF cannot give DMARC an aligned domain, but the message still passes DMARC if a valid DKIM signature is aligned with the From domain.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account