SPF PermError

PermError is SPF's permanent-failure result: the record could not be evaluated, so the check yields no authentication benefit whatsoever — identical in effect to publishing no SPF record. The overwhelmingly common cause is exceeding the 10-DNS-lookup limit (RFC 7208 §4.6.4). The others are publishing two SPF records on one domain, a syntax error, an unknown mechanism, or more than two void lookups.

Updated July 14, 2026 · SPF

The five causes, in order of likelihood

1. Too many DNS lookups (this is nearly always it)

SPF permits 10 DNS-querying terms. Includes nest, so a single include: for a mid-size ESP routinely costs 4–5 lookups on its own. Add three providers and you are over. This is the cause in the large majority of real-world PermErrors, and it has its own page: the SPF 10-lookup limit.

2. Two SPF records on one domain

RFC 7208 §4.5 is unambiguous: a domain publishes one SPF record. Two TXT records starting with v=spf1 is a PermError, even if both are individually valid. This happens when an ESP's onboarding doc says "add this TXT record" and it gets added alongside the existing one rather than merged into it.

✗ v=spf1 include:_spf.google.com ~all
✗ v=spf1 include:sendgrid.net ~all      ← second record: PermError

✓ v=spf1 include:_spf.google.com include:sendgrid.net ~all

3. Syntax errors

A stray character, a missing colon, a mechanism spelled wrong. Common ones: include _spf.google.com (space instead of colon), v=spf1 ... -all -all, or a smart-quote pasted in from a Word document — that last one is more common than you would expect and is invisible in most DNS UIs.

4. An unknown mechanism or modifier

Anything that is not a term SPF defines. Frequently this is a copy-paste of a DMARC or DKIM fragment into an SPF record.

5. More than two void lookups

A "void lookup" is one that returns NXDOMAIN or an empty answer. RFC 7208 §4.6.4 caps these at two. Exceeding the cap is a PermError. In practice this means your record references a hostname that no longer resolves — usually a decommissioned ESP.

Diagnose your domain

We report the live lookup count, the policy, and the parsed record.
Fix DKIM first if you are in a hurry. DMARC passes if either SPF or DKIM passes and aligns. A domain with a broken SPF record but correctly signed, aligned DKIM still passes DMARC and still delivers. DKIM also survives forwarding, which SPF does not. If mail is being rejected right now, getting aligned DKIM working is usually the faster path to stopping the bleeding than untangling an over-budget SPF record.

Frequently asked

What does SPF PermError mean?

PermError is a permanent error: the receiver could not evaluate your SPF record at all. It is not a soft failure or a weaker pass — the result is that SPF gives you nothing, exactly as if the record did not exist. If DMARC depends on SPF rather than DKIM, DMARC fails too.

What is the most common cause of SPF PermError?

Exceeding the 10-DNS-lookup limit. Every include, a, mx, ptr, exists and redirect costs at least one lookup, and includes pull in their targets' lookups recursively, so adding one ESP can spend four or five of your budget at once.

Can two SPF records cause PermError?

Yes, and it is an easy mistake to make. RFC 7208 §4.5 requires that a domain publish exactly one SPF record. If two TXT records begin with v=spf1, the result is PermError. This usually happens when a new ESP's setup guide says 'add this TXT record' and someone adds a second one instead of merging into the existing one.

Does SPF PermError mean my email bounces?

Not by itself, but often in practice. PermError means SPF does not pass. If your DMARC policy is p=reject and DKIM is not passing-and-aligned, then DMARC fails and receivers reject the message at SMTP. Gmail returns 550 5.7.26 in that situation.

Related

Automate this → — free tier, public pricing, API key emailed in about thirty seconds. No call with anyone.