Where you saw it: A DMARC aggregate report listing spf=permerror, an SPF validator, or an Authentication-Results header on a message that was filtered.
Why it happens
- Two SPF records on the same domain. The specification allows one, and a second makes evaluation impossible.
- More than ten DNS lookups during evaluation, which is a hard ceiling rather than a guideline.
- A syntax error: a missing colon after include, a stray space inside the value, or a mechanism the evaluator does not recognize.
- An include pointing at a domain that no longer publishes an SPF record, which turns a valid include into an unresolvable one.
- The deprecated ptr mechanism, which some evaluators now treat as an error rather than ignoring it.
The fix, in order
Count your SPF records first
Run dig +short TXT yourdomain.com and count the lines starting with v=spf1. If there are two, merge them into one and delete the other. This is the fastest fix and the most common cause.
Run the record through a validator that counts lookups
A good checker reports the lookup count and names the mechanism that pushed you over ten. Fix that specific include rather than rewriting the whole record.
Read the value character by character
Look for include without its colon, a double space, a smart quote pasted from a document, or a trailing comma. DNS panels do not validate SPF syntax and will store anything you type.
Resolve each include by hand
For every include:domain in your record, run dig +short TXT domain and confirm it returns an SPF record. A vendor you stopped using may have retired theirs.
Remove ptr and any mechanism you cannot explain
The ptr mechanism is deprecated and slow. If a record contains something nobody on your team can account for, it was probably inherited from a vendor you no longer use.
dig +short TXT example.com | grep spf1More than one line of output is your answer.
How to know it worked
The short version
- Re-run the validator. The lookup count should be ten or fewer and the syntax report clean.
- Send a test message and read Authentication-Results. It should say spf=pass rather than spf=permerror.
- Wait for the next DMARC aggregate report and confirm the permerror rows are gone.
Questions people ask
What is the difference between permerror and fail?
A fail means the sending IP is not authorized, which is a working check returning a negative answer. A permerror means the check could not run at all. One tells you about the sender, the other tells you about your record.
Does permerror mean my mail bounces?
Not by itself. It usually means heavier filtering. It becomes a rejection when your DMARC policy is set to reject and DKIM is not passing either.
Can two SPF records ever be valid?
No. The specification is explicit that a domain publishes one SPF record. Every additional record is an error condition.