PermError (permanent error) is one of the result codes defined by SPF in RFC 7208. It is returned when a receiving mail server tries to evaluate your SPF record but finds it syntactically invalid or otherwise impossible to process. Unlike a TempError, retrying will not help: the fault lies in the published DNS record itself.
The most common cause is exceeding the SPF processing limits. SPF allows a maximum of 10 DNS-lookup mechanisms (include, a, mx, ptr, exists and redirect). Cross that limit and evaluation halts with PermError. Other triggers include more than one SPF record on a domain, malformed syntax, an unknown qualifier, or too many void lookups.
A PermError matters because many receivers treat it as an outright SPF failure. That weakens authentication, harms deliverability and undermines DMARC alignment, since SPF can no longer contribute a clean pass.
To diagnose it, validate your record and count its lookups; consolidating senders or flattening includes usually resolves it. DMARC Engine's done-for-you enforcement keeps your record within limits automatically so PermError does not creep back in.
Check it on your domain
- SPF Checker: validates SPF and counts DNS lookups against the limit of 10.
- DMARC Checker: looks up and validates a domain's DMARC record and policy.