Fix SPF PermError on Inbound Authentication Checks

What's happening

PermError is one of the seven SPF result codes defined in RFC 7208 Section 2.6 alongside Pass, Fail, SoftFail, Neutral, None, and TempError. It signals that the receiver could parse and start evaluating your record but encountered a permanent, unrecoverable problem partway through.

Three causes account for the vast majority of PermError outcomes: exceeding the 10-DNS-lookup limit, having more than one SPF record published at the apex, and a syntax error that breaks tokenization (an unquoted space, a typo in a mechanism, or an unrecognized modifier). Receivers do not retry — PermError is final for that evaluation.

Headers from a PermError look like Authentication-Results: mx.google.com; spf=permerror smtp.mailfrom=example.com or compauth=fail reason=001 in Microsoft 365. Most receivers treat PermError as equivalent to a hard SPF fail, with the additional penalty that DMARC alignment is impossible to satisfy via the SPF leg.

Why it matters

Gmail's February 2024 bulk-sender requirements explicitly require valid SPF — PermError fails the requirement. High-volume senders see immediate temporary throttling (421 4.7.0), and continued PermError sends trigger 5.7.26 rejects.

Microsoft 365 routes PermError mail to junk for tenants with default antispam policies, and Defender for Office 365 marks the message as compauth=fail. Customer-facing transactional mail in particular suffers because receivers correlate the failure with phishing.

PermError silently degrades sender reputation across the board. Spamhaus, Barracuda Reputation, and Cisco Talos all factor SPF result codes into their sender-IP scoring, and a PermError trend over weeks pushes you onto reputation watch lists.

Common causes

• Two or more v=spf1 TXT records at the apex (most common after a DNS migration).
• Total DNS lookups exceeding 10 due to nested includes.
• Typo in a mechanism such as include:spf.mail.gun.org instead of include:spf.mailgun.org.
• Unrecognized modifier or qualifier from copy-pasting examples that include trailing whitespace or smart quotes.
• Use of the deprecated ptr mechanism which can produce PermError on receivers that no longer evaluate it.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Confirm the PermError result and read the reason

   Run a Mail-Tester probe or check the Authentication-Results header on a recent message. The Email Checker on CheckFast labels the precise sub-cause: "too many lookups", "multiple records", or "syntax error at position N". Treat each sub-cause separately.

2. 2

   Verify exactly one SPF record exists

   Run dig +short TXT example.com | grep spf1 and count the lines. If you see two or more v=spf1 entries, merge them into one and delete the duplicate at the registrar. RFC 7208 Section 4.5 says multiple records MUST be treated as PermError.

3. 3

   Count lookups and reduce if over 10

   Use SPF Surveyor (dmarcian) or the CheckFast Email Checker to walk the include chain. If the total is 11+, flatten the largest includes (typically Google or Salesforce) by replacing them with their resolved ip4 ranges, or remove unused vendors entirely.

4. 4

   Check syntax mechanism by mechanism

   Re-type the record from scratch in a plain text editor — do not copy from a PDF or web page that may contain smart quotes or non-breaking spaces. Confirm every mechanism starts with a recognized prefix: ip4:, ip6:, include:, a:, mx:, exists:, all (with optional + - ~? qualifier).

5. 5

   Republish and verify

   Update the TXT record at TTL 300, wait five minutes, and run dig +short TXT example.com again. Then send a test through your production sending path and read the Authentication-Results header. spf=pass is the desired outcome.

6. 6

   Watch DMARC aggregate reports for one week

   Enable rua= reports in your DMARC record if not already done. Review the next two weekly reports — the count of messages with spf=permerror in the auth_results section must be zero. Anything else means the fix did not stick.

Example

# Confirm count of SPF records — must be exactly 1
dig +short TXT example.com | grep -c 'v=spf1'

# Walk the include chain manually
dig +short TXT _spf.google.com
dig +short TXT spf.mailgun.org

Quick triage commands for diagnosing the three flavors of PermError.

Related fixes