Skip to main content
New SPF lookups must resolve in milliseconds — why a DMARC tool's add-on isn't enough Learn Why → →
Foundational 14 min read

SPF Errors and Troubleshooting Guide: Fix Every SPF Failure

Brad Slavin
Brad Slavin General Manager

Quick Answer

SPF errors fall into several categories: PermError (permanent failures caused by syntax mistakes, exceeding the 10-DNS-lookup limit, or unresolvable includes), TempError (temporary DNS resolution failures), 550 rejections (the receiving server explicitly rejects mail that fails SPF), and alignment failures (the SPF-authenticated domain does not match the From header domain required by DMARC). Each error type has specific diagnostic steps and fixes. Use an SPF validator to identify the exact error, then follow the targeted fix for that error type.

Share

SPF errors are the single most common cause of email deliverability problems for domains that have already published an SPF record. A properly formatted record can still fail for dozens of reasons - from exceeding the DNS lookup limit to a third-party service changing their include domain without notice.

Per RFC 7208, an SPF check returns one of eight possible results: None, Neutral, Pass, Fail, SoftFail, TempError, PermError, or an implementation-specific result. Understanding which result your domain is producing - and why - is the first step to fixing the problem.

This guide covers every category of SPF error, explains the root causes, and links to detailed fix guides for each specific scenario.

How SPF Evaluation Works (The 60-Second Version)

Before diving into errors, it helps to understand the evaluation flow. When a receiving server gets an email claiming to be from your domain:

  1. The server extracts the domain from the MAIL FROM (Return-Path) address
  2. It performs a DNS lookup for the TXT record at that domain
  3. It parses the SPF record and evaluates each mechanism against the connecting IP
  4. It returns a result: Pass, Fail, SoftFail, Neutral, TempError, PermError, or None

If the record cannot be parsed (syntax errors, too many lookups, unresolvable domains), the result is PermError - a permanent failure that cannot be retried. If a DNS timeout occurs during evaluation, the result is TempError - a temporary failure that may be retried.

For a thorough walkthrough of the protocol, see What is SPF? A Detailed Guide on Sender Policy Framework.

Category 1: PermError - Permanent Processing Failures

PermError is the most damaging SPF result because it means the record itself is broken. Every message from the domain fails SPF until the record is fixed. There is no retry - the error is permanent by definition.

Exceeding the 10-DNS-Lookup Limit

The problem: SPF evaluation allows a maximum of 10 DNS mechanism lookups. Each include, a, mx, redirect, and exists mechanism triggers a DNS lookup. Nested includes (an include that itself contains includes) count toward the total. When the total exceeds 10, evaluation stops immediately with a PermError.

How to diagnose it: Use the SPF Validator to check your domain’s lookup count. Any count above 10 is the cause.

How to fix it: You have several options:

  • Remove unnecessary include mechanisms for services you no longer use
  • Replace a and mx mechanisms with explicit ip4 or ip6 entries (these do not count as DNS lookups)
  • Use SPF flattening to resolve includes to IP addresses
  • Use AutoSPF for automated dynamic flattening that stays current as provider IPs change

Detailed guides:

Multiple SPF Records on the Same Domain

The problem: A domain must have exactly one SPF TXT record. If two or more TXT records begin with v=spf1, SPF evaluation returns PermError. This commonly happens when a second service is added and someone creates a new SPF record instead of merging the include into the existing one.

How to fix it: Merge all include mechanisms into a single SPF record and delete the duplicates.

Detailed guides:

Syntax Errors

The problem: SPF records have strict syntax requirements. Common mistakes include:

  • Misspelling v=spf1 (e.g., v=spf 1 with a space, or spf1 without the version prefix)
  • Using invalid mechanism names or incorrect CIDR notation
  • Including whitespace or special characters that break parsing
  • Using the deprecated SPF record type (Type 99) instead of a TXT record

How to fix it: Validate your record with the SPF Checker and correct the syntax error. Use the SPF Record Generator to build a syntactically correct record from scratch.

Detailed guides:

Unresolvable Include Domains

The problem: If an include mechanism references a domain that does not exist or does not have an SPF record, the include fails and may produce a PermError. This can happen when a third-party service changes their SPF include domain or when a typo is introduced.

How to diagnose it: Run dig TXT <include-domain> for each include in your SPF record and verify each one returns a valid SPF record.

Detailed guides:

Overly Long SPF Records

The problem: While there is no hard character limit on SPF records themselves, DNS TXT records are limited to 255 characters per string. Records longer than 255 characters must be split into multiple strings within a single TXT record. Some DNS providers handle this automatically; others do not. If the splitting is done incorrectly, the record breaks.

Additionally, RFC 7208 recommends keeping the total response under 512 bytes to avoid DNS truncation issues.

Detailed guides:

Category 2: TempError - Temporary DNS Failures

TempError means the receiving server could not complete SPF evaluation because of a temporary DNS issue. Unlike PermError, a TempError may resolve itself when the DNS issue clears. However, some receiving servers treat TempError as a failure and reject the message.

Common Causes

  • DNS server downtime - Your DNS provider or authoritative nameservers are temporarily unavailable
  • DNS timeout - The SPF record requires multiple DNS lookups that collectively exceed the receiver’s timeout threshold
  • Network issues - Intermittent connectivity between the receiving server and your nameservers

What to Do

TempErrors are often transient and resolve on their own. If they persist:

  1. Check your DNS provider’s status page for outages
  2. Verify your nameservers are responding using dig NS yourdomain.com
  3. Reduce the number of DNS lookups in your SPF record to speed up evaluation
  4. Consider using a more reliable DNS provider with a globally distributed network

Category 3: 550 Rejections - SPF Policy Enforcement

A 550 error means the receiving server explicitly rejected the message based on SPF policy. The SPF record was processed successfully, but the sending server was not authorized.

550 5.7.0 Email Rejected Per SPF Policy

This is the most common 550 rejection. It means the sending IP address is not listed in the domain’s SPF record, and the record uses -all (hard fail) or the receiving server enforces ~all (soft fail) as a rejection.

Detailed guides:

550 SPF Check Failed

This variant indicates the SPF check ran but returned Fail, and the receiving server is enforcing the failure.

Detailed guides:

550 From Address Violates Policy

This error can be caused by case-sensitivity issues in the From address, particularly with Google Workspace and other providers that enforce strict username normalization.

Detailed guide:

550 5.7.15 Access Denied

This rejection is specific to certain mail platforms that enforce additional SPF-related access controls.

Detailed guide:

554 5.7.5 DMARC Error

While technically a DMARC error, this rejection often has its root cause in SPF alignment failures.

Detailed guide:

Category 4: Alignment Failures

SPF alignment failures occur when SPF passes (the sending server is authorized) but the domain authenticated by SPF does not match the domain in the visible From header. This is a DMARC requirement, not an SPF requirement - but the root cause is in the SPF configuration.

Why Alignment Matters

DMARC requires that either SPF or DKIM “aligns” with the From header domain. For SPF alignment, the domain in the Return-Path (envelope sender) must match the domain in the From header. If your email platform uses a different Return-Path domain (which many do by default), SPF will pass but alignment will fail.

Detailed guides:

Category 5: Broken and Misconfigured Records

These are configuration errors that do not necessarily produce a PermError but still cause SPF to fail or behave unexpectedly.

Broken SPF Records

A “broken” SPF record is any record that does not work as intended, even if it is syntactically valid. Common causes include outdated include mechanisms, missing sending sources, and incorrect IP ranges.

Detailed guides:

Misconfigured Include Statements

Detailed guides:

Choosing the Wrong Qualifier

The all mechanism at the end of your SPF record determines what happens to senders not explicitly listed. Using +all (pass all) effectively disables SPF protection, while -all (hard fail) without a complete sender inventory will block legitimate mail.

Detailed guides:

Diagnostic Tools and Workflow

When you encounter an SPF-related email delivery problem, follow this diagnostic workflow:

Step 1: Check the Error Message

The bounce message or NDR (Non-Delivery Report) usually contains the specific SPF failure reason. Look for keywords like “PermError,” “550,” “SPF check failed,” or “alignment.”

Step 2: Validate Your SPF Record

Use the SPF Validator to check for:

  • Syntax errors
  • DNS lookup count (must be 10 or fewer)
  • Multiple SPF records on the same domain
  • Unresolvable include domains
  • Character limit issues

Step 3: Check Email Headers

If you have access to a delivered copy of the message (even in spam), examine the Received-SPF and Authentication-Results headers to see the exact SPF result and the IP that was evaluated.

Detailed guide: How to Interpret Pass, Fail, Neutral Results from SPF Checker

Step 4: Use DMARC Reports

DMARC aggregate reports provide a comprehensive view of all SPF (and DKIM) results for your domain across all receiving servers. They reveal problems you might not see from a single test.

Detailed guide: How to Utilize DMARC Reports to Resolve SPF Errors

Step 5: Test with External Tools

Run your domain through multiple validation tools to get a complete picture:

Preventing SPF Errors Before They Happen

The best approach to SPF errors is prevention. These practices will reduce the likelihood of encountering issues:

  1. Maintain a sender inventory - Document every service that sends email from your domain and update it whenever a new service is added
  2. Monitor DNS lookup count - Track your count and plan ahead before adding new services
  3. Use dynamic SPF flattening - AutoSPF automatically keeps your record within limits as provider IPs change
  4. Deploy DMARC in monitor mode first - Use p=none to collect reports before enforcing SPF failures
  5. Test before publishing - Always validate changes with the SPF Checker before updating DNS
  6. Set up alerts - Monitor for SPF record changes and lookup limit violations

For a comprehensive guide to fixing common SPF errors, see Fixing Typical SPF Errors and Handling Common SPF Errors the Right Way.

Topics

SPF SPF record email security email deliverability troubleshooting PermError email authentication
Brad Slavin
Brad Slavin

General Manager

Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base.

LinkedIn Profile →

Ready to get started?

Try AutoSPF free — no credit card required.

Book a Demo

Related Articles

Foundational 15m

SPF Record Setup Guide: How to Configure SPF on Every Major Platform

Foundational 15m

SPF Record Syntax Explained: The Complete Guide to Mechanisms, Qualifiers, and Limits

Foundational 15m

What is DMARC? The Complete Guide to Domain-Based Message Authentication

Foundational 17m

10 Reasons The SPF Standard Is Essential For Protecting Your Domain