Fix SPF PermError and TempError
A practical DIY guide to diagnosing and resolving the most common SPF record errors — from syntax issues to DNS lookup limits.
SPF PermError (Permanent Error)
A permerror occurs when there is a fundamental problem with your SPF record that prevents receiving servers from evaluating it. The record is considered invalid, and email providers like Gmail and Outlook cannot verify whether a sender is authorized.
Common causes:
- - Multiple SPF records for one domain
- - Syntax errors (typos, formatting)
- - Exceeding the 10 DNS lookup limit
- - Exceeding the void lookup limit
- - Exceeding 255 character length
SPF TempError (Temporary Error)
A temperror is a transient issue — typically a DNS timeout or a temporary server problem. These usually resolve on their own without intervention.
What to do:
- - Wait a few hours — most resolve automatically
- - If only one mailbox reports it, likely a receiver-side issue
- - If multiple mailboxes report it, check your DNS provider
- - Monitor your email server logs for patterns
SPF Fail vs. SPF PermError — What's the Difference?
SPF Fail
The SPF record was evaluated successfully, but the sending IP address is not authorized to send emails for that domain. The record works; the sender just isn't on the list.
SPF PermError
The SPF record itself is broken or invalid. The receiving server cannot even evaluate whether the sender is authorized because the record has fundamental problems.
Step-by-Step: Fix SPF PermError
Check Your SPF Record for Errors
Run your domain through an SPF checking tool like Kitterman SPF or AutoSPF's SPF Record Checker to diagnose existing problems.
Fix Multiple SPF Records
Merge all SPF records into one. Include only one "a" mechanism, one "mx" mechanism, combine all "include" statements, and ensure the record ends with a single qualifier (-all, ~all, or ?all).
Fix Syntax Issues
Check for extra spaces, spelling mistakes, uppercase letters, extra dashes before qualifiers, commas between mechanisms, and ensure the record starts with v=spf1.
Stay Within the DNS Lookup Limit
Remove unnecessary "include" statements, eliminate the "ptr" mechanism, delete invalid or unused domain references, and consider SPF flattening with AutoSPF.
Fix Void Lookup Errors
Remove any "include" mechanisms that reference invalid, spoofed, or non-existent domains. Ensure all referenced IP addresses and mail servers are active and valid.
Verify and Monitor
After making changes, verify your SPF record with an SPF checker tool. Send test emails to external accounts and monitor email server logs for ongoing issues.
SPF Syntax Checklist
- Record starts with
v=spf1 - No extra spaces before or after the record string
- All lowercase letters (no uppercase)
- Single space between each mechanism (no commas)
- Only one qualifier at the end (
-all,~all, or?all) - Only one SPF record per domain
- 10 or fewer DNS lookups total
Fix Your SPF Record, Free
Give AutoSPF a test drive for 30 days at no cost. Fix your broken SPF in less than 60 seconds.
World-Class Support
"Helped us go beyond capacity"
AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.
Verified User
Financial Services · Mid-Market (51-1000 emp.)
"Great service and great support"
AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.
Greg F.
Mid-Market (51-1000 emp.)