Troubleshooting
Fix SPF PermError and lookup-limit problems
Diagnose multiple records, invalid syntax and the ten-lookup limit.
8 minute readUpdated October 16, 2026
Common causes
A PermError means the receiver could not evaluate the policy reliably. It is not the same as a normal SPF fail.
- More than one v=spf1 TXT record
- More than ten DNS-causing mechanisms or modifiers
- An include that returns another permanent error
- Invalid mechanisms, qualifiers or malformed IP ranges
Count recursively
include, a, mx, ptr, exists and redirect can cause DNS work. Includes can expand into more lookups, so count the full evaluation path rather than only visible tokens.
Repair without authorizing too broadly
Inventory active senders, remove confirmed obsolete services and prefer provider-supported account-specific records. Flattening introduces maintenance risk because provider addresses change.