Table of Contents
Introduction
What SPF PermError means for UK businesses
This error isn’t random — your SPF record is chasing external includes until receivers give up, and legitimate mail gets dumped in spam. The fix is to flatten or consolidate providers and cut unnecessary lookups, without breaking Microsoft 365 or Google Workspace routing.
Why the 10 DNS lookup limit matters for email deliverability
RFC 7208 restricts lookups to ten during SPF evaluation; exceeding this limit can trigger a PermError, increasing bounces and reducing inbox placement.
SPF PermError Explained
How the 10 lookup limit is counted
SPF evaluation counts each DNS query triggered by mechanisms such as a, MX, include, redirect, and ptr. If the total number of lookups reaches ten during a single evaluation, the result is a PermError. This cap applies to the evaluation of the domain being checked, not to separate messages or recipients.
Void lookups also count toward the limit. If the server cannot complete a lookup due to a missing record or negative response, it still contributes to the total and can push the record past the threshold.
Common causes of permerror in SPF records
- Excessive use of include mechanisms from multiple sources
- Aggregating multiple A or MX lookups without flattening
- Unnecessary or outdated redirect statements that chain DNS queries
- Domain owners adding PTR or non essential mechanisms
- Ambiguous or broken DNS records causing extra lookups during evaluation
Practical Solutions to Fix the Issue
Flattening SPF records and when to use it
Flattening converts a chain of DNS lookups into a single response, reducing the total lookups during SPF evaluation. This approach is useful when you rely on multiple include or redirect mechanisms and the total count risks breaching the 10 lookup limit.
Use flattening when you control the DNS setup and have access to a stable provider that supports SPF flattening or a dedicated tool. It is most effective for domains with frequent changes to single source records, as it minimizes dynamic lookups while preserving authentication intent.
- Benefits include a lower risk of PermError and more predictable SPF evaluation
- Drawbacks can include the need for occasional updates if included sources change
- Test thoroughly across common receivers to ensure DKIM remains unaffected
Alternative mechanisms to reduce lookups without breaking deliverability
- Remove unnecessary a or MX lookups from the record when possible
- Replace multiple includes with a single, well maintained source
- Prefer the ip4 and ip6 mechanisms for known sending hosts
- Avoid long redirect chains and eliminate deprecated or non essential mechanisms like PTR
| Strategy | What it does | When to consider |
|---|---|---|
| SPF flattening | Consolidates lookups into a single response | High risk of 10 lookup violations due to many includes |
| Reduce includes | Limits external dependencies in the SPF | Multiple trusted sources in use |
| Use ip4/ip6 | Directly specifies sending hosts | Known infrastructure with stable addresses |
FAQ
What causes SPF permerror in the UK context
Typical triggers include a high number of DNS lookups from multiple includes, unnecessary redirects, and layered mechanisms that push the lookup count toward the limit.
- How can I tell if I am over the limit
- What is flattening and when should I use it
- Which mechanisms contribute most to lookups
Conclusion
Addressing SPF PermError requires reducing DNS lookups while preserving valid authentication. Flattening and careful mechanism selection provide practical paths for UK email deliverability.
