auth.spf.permerror

SPF Record Invalid

What we check

We parse the apex SPF record and recursively validate its include: and redirect= targets. A record with invalid syntax, or a referenced domain that does not resolve to exactly one valid SPF record, produces an SPF PermError at receiving mail servers.

What this finding means

The SPF policy has a permanent error and cannot be evaluated reliably. Receivers that hit a PermError treat SPF as broken — the record provides no protection and can hurt deliverability, because a PermError is not the same as a clean pass.

Common causes: a typo in a mechanism, an include: pointing at a domain with no SPF record (or more than one), an unterminated record, or use of a macro or mechanism the record's syntax got wrong.

Why it matters

• No protection. A record that errors out authorizes nothing. SPF neither passes nor usefully fails — receivers get an indeterminate result.
• DMARC impact. SPF PermError does not count as an SPF pass, so DMARC alignment via SPF is lost. If DKIM alignment is also missing, DMARC fails.
• Silent. Nothing on your side signals the error; only the receiver sees it. The record can look plausible in the zone file while failing at every receiver.

How to fix

1. Validate the full policy with an SPF checker that expands every include: and redirect= and reports the exact broken term.

2. Fix the referenced targets. Every include:/redirect= domain must itself publish exactly one valid v=spf1 record. A missing or duplicated record at the target propagates as a PermError to yours.

3. Check syntax. One v=spf1 at the start, valid mechanisms only, a single all at the end:

   example.com.  IN  TXT  "v=spf1 ip4:203.0.113.0/24 include:_spf.your-provider.example -all"
   

How it's graded

An invalid SPF record carries a 30-point deduction in the Authentication category. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT example.com
"v=spf1 include:broken.example -all"

Evaluating include:broken.example → no v=spf1 record at broken.example
Result: permerror (unresolvable include target)

References

• RFC 7208 — Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1