SPF glossary
What does SPF permerror mean and how do you fix it?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
SPF permerror means the receiver hit a permanent error evaluating your record — it can't be interpreted, so SPF produces no verdict at all. Retrying won't help; the record itself is broken. Top causes: more than 10 DNS lookups, multiple v=spf1 records, syntax errors, or an include: pointing at a domain with no SPF record.
permerror at a glance | |
|---|---|
| Tag | permerror (SPF evaluation result) |
| Valid values | One of SPF's seven results: none · neutral · pass · fail · softfail · temperror · permerror |
| Default | Not something you publish — receivers compute it when the record can't be evaluated. |
| Where it goes | Appears in Authentication-Results headers (spf=permerror) and in DMARC aggregate reports. |
How permerror works
permerror is the receiver giving up: your SPF record, as published, cannot be correctly interpreted. Unlike a fail — where evaluation worked and the sender simply wasn't authorized — a permerror means evaluation itself broke. And unlike a temperror, it's deterministic: every receiver, every retry, same result, until the record is fixed.
The usual suspects, roughly in order: the record needs more than 10 DNS lookups (the most common cause by far, and the easiest to hit without noticing); the domain has two or more records starting v=spf1; a syntax error — a stray character, a bad CIDR, an en dash pasted from a formatted document; or an include:/redirect= pointing at a domain that publishes no SPF record.
The DMARC consequence is what makes it urgent: a permerror means SPF contributes no aligned pass, so your DMARC verdict rests entirely on DKIM. If a source's DKIM alignment is also missing, that mail now fails DMARC — and at p=reject, a broken SPF record can quietly turn into your own legitimate mail being blocked.
Correct record vs common mistake
Correct
v=spf1 include:_spf.google.com ip4:192.0.2.0/24 -allOne record, valid syntax, well under 10 lookups — nothing here can permerror.
Common mistake
v=spf1 ip4:192.0.2.0/24 –allThe qualifier is an en dash, not a hyphen — a classic copy-paste-from-a-formatted-document error. One wrong character permerrors the entire record.
Troubleshooting permerror
| Issue | Likely cause | Fix |
|---|---|---|
| spf=permerror in headers or DMARC reports | Usually the 10-lookup limit — or two v=spf1 records on the domain | Count lookups with an SPF checker and confirm exactly one TXT record starts v=spf1 |
| permerror appeared without any record change | An included domain changed underneath you — its record was removed, or its nested lookups grew | Audit the full include tree; remove or replace the broken include |
| Record looks fine but still permerrors | Invisible characters from copy-paste — smart quotes, en dashes, non-breaking spaces | Retype the record in a plain-text editor and republish; then re-check |
Why it matters for MSPs
A permerror tenant looks configured in DNS — the TXT record is right there — while contributing nothing to authentication. Across 50–200 client domains, these hide among healthy ones indefinitely, because nothing alerts on them: DNS resolves, mail mostly delivers on DKIM's back, and the audit checkbox stays green. Only reading the reports finds them.
Trusted by MSPs
“We increased our meetings booked by 21% and slept better at night knowing our emails are now secured”
Marc-André Campagna — CEO, gaiiaRead the case study →
DMARC software that does the work
In the aggregate reports, a permerror shows up as the absence it is: no aligned SPF pass, DMARC leaning on DKIM alone. Palisade reads every client domain's reports, surfaces exactly that evidence, and advances each domain to `p=reject` only when the data says legitimate mail will survive.
1 domain free up to 1,000 emails/month
Questions readers ask