Mail errors · SPF, DKIM and DMARC results

What does “spf=permerror” mean?

Your SPF record could not be read, so it protects nothing.

Last read 14 October 2026 from the sources at the foot of this page.

Check my firm Read the steps

Message header

Authentication-Results

spf=permerror

As the standard prints it.

What does it mean?

PermError is a permanent error: every message gets the same result until the record is fixed. For DMARC it does not count as an SPF pass.

What exactly does the source say?

permerror: A permanent error occurred. For example, the domain has a badly formatted SPF record.
From Microsoft: Email message headers in Microsoft 365, read 14 October 2026.

Why would a small firm see it?

A second SPF record added for a new service, an include for every tool the firm ever tried, or an include that points at a name that no longer exists.

How do I fix it?

Look up the TXT records at your domain.Count the ones that start v=spf1: there must be one.
If there are two, put every service from both into one record, then delete the other.
Check the record again after the change.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

What else do the sources say?

spf=<pass (IP address)|fail (IP address)|softfail (reason)|neutral|none|temperror|permerror> smtp.mailfrom=<domain>
From Microsoft: Email message headers in Microsoft 365, read 14 October 2026.

A "permerror" result means the domain's published records could not be correctly interpreted.
From RFC 7208, Sender Policy Framework, read 14 October 2026.

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".
From RFC 7208, Sender Policy Framework, read 14 October 2026.

If the resultant record set includes more than one record, check_host() produces the "permerror" result.
From RFC 7208, Sender Policy Framework, read 14 October 2026.

SPF implementations SHOULD limit "void lookups" to two. An implementation MAY choose to make such a limit configurable. In this case, a default of two is RECOMMENDED. Exceeding the limit produces a "permerror" result.
From RFC 7208, Sender Policy Framework, read 14 October 2026.

Sources

Where does this come from?

Microsoft: Email message headers in Microsoft 365learn.microsoft.comRead 14 October 2026
RFC 7208, Sender Policy Frameworkrfc-editor.orgRead 14 October 2026

07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only

Who sees itYou alone

Delivery72 hours from confirmation

Meeting firstNone

Reading requestPrivate

Firm name

Problem: Enter your firm's name.

Your name

Problem: Enter your name.

Work email

Problem: Enter a full address, like [email protected].

Website

Problem: That does not look like a website. Try yourdomain.com.

What kind of business

What prompted this (optional)

How you heard about us (optional)

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy