SPF PermError: Permanent error
SPF PermError means receivers cannot evaluate your SPF record. The usual causes are more than 10 DNS lookups (nested includes), invalid syntax, or multiple SPF TXT records on one domain. Receivers treat permerror as a hard evaluation failure, which breaks DMARC on the SPF leg.
Quick fix (3 steps)
- 1
Confirm exactly one SPF TXT record exists on the sending domain; merge or delete duplicates in Cloudflare or your DNS host.
- 2
Paste the record into the SPF checker and fix syntax, then count lookups. Remove dead ESP includes before adding flattening.
- 3
Re-validate until lookup count is 10 or fewer, then end with -all on production domains and test Authentication-Results on a Gmail message.
Common questions
What causes SPF PermError?+
Common causes include more than 10 DNS lookups, recursive include loops, invalid SPF syntax, or multiple SPF TXT records on one domain.
Is PermError worse than SoftFail?+
Yes. PermError means receivers cannot evaluate SPF reliably, so mail may fail authentication checks entirely rather than soft-failing.
Should I use an SPF flattening service?+
Flattening replaces nested includes with IP lists to stay under 10 lookups. It works but requires ongoing updates when ESPs change IPs. Audit includes first.