Short answer
SPF PermError (permanent error) means the receiver couldn't evaluate your domain's SPF record at all, so SPF neither passes nor fails. RFC 7208 lists the causes: more than 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect), more than one SPF record on the domain, a syntax error, or more than two lookups that return nothing.
A PermError doesn't count as an SPF pass, so for DMARC your mail has to pass on DKIM instead. Fix the record: merge duplicate records into one, remove includes for services you no longer use, and stay at 10 lookups or fewer.
On this page
What SPF PermError means
SPF checks have seven possible results: pass, fail, softfail, neutral, none, temperror and permerror. temperror is a temporary DNS problem and is worth retrying. permerror means the published record itself is broken, and only the domain owner can fix it.
You'll see it in a message's Authentication-Results header as spf=permerror, in DMARC aggregate reports, and sometimes in a bounce. RFC 7372 assigns the enhanced code X.7.24 ("SPF validation error") to it; Microsoft 365 reports SPF problems as 5.7.23.
Common causes
| Cause | Example | Fix |
|---|---|---|
| More than 10 DNS lookups | include: for five services, each of which includes two or three more | Remove services you no longer send through; replace an include with the ip4:/ip6: ranges only if the service publishes stable ones; move a sending service to its own subdomain |
| Two SPF records | Separate v=spf1 include:a.com ~all and v=spf1 include:b.com ~all TXT records | Merge into one: v=spf1 include:a.com include:b.com ~all |
| Syntax error | v=spf1 ip4:203.0.113.0/33 ~all, include: a.com (stray space), a typo in a mechanism | Correct the term; generate a clean record |
| More than two void lookups | include: of a domain that no longer has an SPF record | Remove the dead include |
Limits from RFC 7208, sections 4.5 and 4.6.4.
The 10-lookup limit counts every nested lookup, not just the includes you can see. ip4, ip6 and all don't count. The SPF checker expands the whole tree and shows your total.
What receivers do with a PermError
- For DMARC, a PermError is not a pass. If DKIM passes and aligns with your From domain, DMARC still passes and the mail is usually fine.
- If DKIM doesn't save it, the message fails DMARC and the From domain's policy applies. At Gmail that can mean 550 5.7.26; at Microsoft 365 a
5.7.23SPF violation or a5.7.509DMARC reject. - Some receivers treat a PermError as a fail on its own, as RFC 7208 allows them to.
How to fix it
- 1
Check the record
Run your domain through the SPF checker. It reports duplicate records, syntax errors and the total lookup count.
- 2
List who actually sends
Make a list of every service that sends with your domain in the return-path. Remove includes for anything not on it.
- 3
Rebuild one clean record
Use the SPF record generator to produce a single record with the remaining includes and a
~allor-allat the end. - 4
Split by subdomain if you're still over 10
Send product mail from
mail.example.comand marketing fromnews.example.com, each with its own SPF record and lookup budget. - 5
Confirm DKIM
Whatever happens with SPF, make sure DKIM passes with your own domain using the DKIM checker. It's the check that survives forwarding.
How Groundmail handles SPF
Groundmail asks for one include in your SPF record, include:spf.groundmail.dev, plus a return-path CNAME (rp.yourdomain) that points at our servers, so SPF for the envelope is checked on records we maintain. When the importer moves a domain from another provider, it edits your existing SPF record rather than adding a second one. Every message is DKIM-signed with your domain's own key, so DMARC can pass on DKIM even if your root SPF record has a problem.
If a receiver does refuse mail for authentication, for example Gmail's 550 5.7.26, Groundmail records it as a block bounce: the address isn't suppressed, and the reply text is in bounce_reason.
Frequently asked questions
What is the SPF 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 mechanisms or modifiers that need a DNS query: include, a, mx, ptr, exists and redirect, counted across all nested includes. Going over returns PermError.
Can I have two SPF records?
No. A domain must have at most one TXT record starting with v=spf1. Two records cause a PermError. Merge them into one.
Is SPF PermError the same as SPF fail?
No. Fail means the record was read and the sending IP isn't allowed. PermError means the record couldn't be read properly. Neither counts as a pass for DMARC, and some receivers treat PermError as a fail.
Does SPF flattening fix PermError?
It can cut the lookup count by replacing includes with IP ranges, but those ranges change when a provider adds servers, and a stale flattened record silently fails. Removing unused includes or splitting senders across subdomains is safer.
Sources
Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.