SPF permerror: what it means and how to fix it

A permerror (permanent error) means a receiving server could not evaluate your SPF record because it is invalid — most often because it exceeds the 10 DNS-lookup limit. The result is treated as an SPF failure.

What SPF permerror means

SPF evaluation returns one of several results: pass, fail, softfail, neutral, none, temperror, and permerror. A permerror specifically means the record could not be processed at all — it is malformed or exceeds a published limit. Receivers do not treat a permerror as a pass, so your mail loses SPF authentication.

Common causes of a permerror

• Too many DNS lookups — more than 10 lookup mechanisms (by far the most common cause). The exact wording is often “too many DNS lookups” or “maximum DNS interactive terms limit (10) exceeded.”
• More than 2 void lookups — includes that resolve to nothing.
• Multiple SPF records — more than one v=spf1 TXT record on the domain.
• Syntax errors — a malformed mechanism, a bad record, or text past the 255-character string limit.
• A deprecated ptr mechanism that fails to resolve.

How to fix an SPF permerror

1. Confirm the cause. Check your lookup count and record validity with an SPF checker. If it’s over 10, that’s your permerror.
2. Ensure a single record. Merge any duplicate v=spf1 records into one.
3. Prune, then flatten. Remove dead includes; if real senders still exceed 10, flatten or switch to a macro.
4. Keep it from recurring. A managed, self-healing record prevents a fixed record from silently drifting back into failure when providers change IPs.

Why this matters for DMARC

A permerror means SPF didn’t return a clean pass. Under DMARC, that removes SPF as a passing authentication method, so alignment now rests on DKIM alone. If DKIM also fails or isn’t aligned, a p=quarantine or p=reject policy will send legitimate mail to spam or bounce it outright. Keeping SPF under the limit is a prerequisite for enforcing DMARC safely.