What SPF PermError means
PermError is a permanent SPF processing error, not the same result as SPF fail. It means the published policy could not be evaluated correctly and is unlikely to succeed without a configuration change.
This scanner can identify a missing record, unsafe policy and an estimated over-limit include chain. It does not implement every branch of a receiver's full SPF evaluator, so compare the diagnosis with the exact Authentication-Results or bounce text.
Common causes
More than 10 DNS lookups
The evaluated SPF path exceeds the RFC limit across includes and other DNS-querying terms.
Multiple SPF records
Publishing more than one v=spf1 record for the same name prevents a valid single policy from being selected.
Invalid mechanism syntax
Malformed qualifiers, mechanisms, modifiers or domain specifications can make the record invalid.
Excessive void lookups
Repeated DNS answers with no records or non-existent names can trigger a receiver's void-lookup limit.
How to fix it
- Copy the exact PermError detail from the bounce or Authentication-Results header.
- Keep exactly one v=spf1 TXT record at the sending domain.
- Remove obsolete includes and reduce the evaluated DNS-querying terms to 10 or fewer.
- Correct invalid mechanisms or modifiers using the syntax in RFC 7208; do not guess at provider values.
- Retest the same sending path because SPF evaluation depends on the envelope sender domain and sending IP.
FAQ
No. Fail is a policy result for a sender that did not match. PermError means the receiver could not evaluate the SPF policy correctly.
Yes. Too many DNS lookups, multiple SPF records and invalid syntax are examples of permanent processing errors.
No. It diagnoses the public SPF configuration and lookup tree available at scan time. The sending IP, envelope sender and receiver behavior are needed for a complete SPF evaluation.