On this page
Short answer
SPF PermError means the receiver could not evaluate your SPF record at all. The causes are two SPF records on one domain, more than 10 DNS lookups across includes, more than two lookups that return nothing, or a syntax error. DMARC treats PermError like a fail, so mail can bounce or land in spam. Merge to one record, cut includes you no longer use, and check the lookup count.
The four causes
RFC 7208 defines when an SPF check ends in PermError:
Cause | Rule | How it happens |
|---|---|---|
Two SPF records | A domain may publish only one | Adding a new provider as a second TXT record instead of merging |
More than 10 DNS lookups |
| Stacking includes for every tool; each include can hide several more |
More than 2 void lookups | Lookups that return no record count separately; more than two is an error (section 4.6.4) | Includes of tools you cancelled, typos in domains |
Syntax error | An unknown mechanism or a malformed term (section 4.6) |
|
An include: that points to a domain without an SPF record is also a PermError (section 5.2).
PermError, fail and softfail
These are different results:
fail(from-all): the record is valid and the sending IP is not in it. Gmail rejects some of these with 550 5.7.26 "has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks".softfail(from~all): the IP is not in the record, and the domain asks receivers to accept but treat it with suspicion.permerror: the record itself is broken, so no IP passes. Every email from the domain fails SPF until it is fixed, whichever server sent it.
For DMARC, all three are a non-pass for SPF. Mail still passes DMARC if DKIM passes for your domain, which is why a broken SPF record sometimes goes unnoticed until DKIM breaks too.
Free guide19 min read
Send 100,000 cold emails a month
Domains and mailboxes you need, DNS, warmup, lists, copy and follow-ups, with a launch checklist, sent to your inbox.
How to fix it
Check the record with the SPF checker: it counts lookups through every include and flags duplicates and syntax errors.
Merge duplicates into one record:
v=spf1 include:first include:second ~all.Remove includes for tools you no longer use. This is the cheapest way under 10.
Move cold email to separate domains. A cold email domain needs one or two includes; the main domain keeps CRM, helpdesk and marketing tools.
Flatten only as a last resort. Replacing includes with IP addresses keeps the count down, but the IPs change without notice. The SPF flattening tool shows the trade-off, and the SPF record generator writes a clean record from your providers.
After the change, send a test to Gmail and look for spf=pass in the headers, or paste them into the email header analyzer.
What we recommend at Outreach2day
Keep cold email on its own domains, with SPF that lists only the sending service. The domains we set up get one short SPF record for our sending servers, a few lookups at most.
Sources
- RFC 7208: Sender Policy Framework (SPF): rfc-editor.org/rfc/rfc7208
- Google Workspace Admin Help: Gmail SMTP errors and codes: support.google.com/a/answer/3726730
Related answers
- Why Does DMARC Fail When SPF and DKIM Pass?Bounces and errors
- Why Does DKIM Fail, and How Do I Fix It?Bounces and errors
- What Does 550 5.7.26 Mean, and How Do I Fix It?Bounces and errors
- Do I Need SPF, DKIM and DMARC for Cold Email?Volume and setup
In depth on the blog
- SPF, DKIM and DMARC Test: Check Your Records15 min read
- Google Workspace SPF, DKIM and DMARC Setup12 min read
