Errors
SPF PermError — Your SPF Record Has Too Many Lookups
SPF PermError (Permanent Error) means your SPF record is invalid and cannot be evaluated. Receiving mail servers treat it as a hard failure and may reject your email or send it to spam. The most common cause is exceeding the 10 DNS lookup limit — add too many email providers and you hit PermError without any warning.
Count Your SPF Lookups
Enter your domain — see exactly how many lookups your SPF record uses and which providers are causing the problem.
What this error means
SPF allows exactly 10 DNS lookups to evaluate your record. Add too many email providers — SendGrid, Mailgun, Google, HubSpot — and each one adds lookups. Go over 10 and receivers return PermError. They may reject the mail outright.
How to diagnose
Run DNS Preflight on your domain. Expand the SPF lookup tree — it shows exactly which provider burns each lookup and your running total.
The fix
Replace include: statements with the IP ranges they resolve to. You trade zero lookups for keeping the list updated when vendors move subnets.
Fix it step by step
include: with ip4: / ip6: entries in your SPF recordRun DNS Preflight to count SPF lookups
Open DNS Preflight →FAQ
What causes SPF PermError?
Too many DNS lookups or invalid SPF syntax. Too many include: statements is the usual cause.
Will SPF PermError make my email bounce?
Depends on the receiver. Many treat PermError as fail and reject or spam-folder the mail.
What is SPF flattening?
Replacing include: with the actual IP ranges they resolve to — those hops then cost zero lookups.
How do I check my SPF lookup count?
Run DNS Preflight — the SPF tree expands includes and shows a running total.
Does SPF PermError affect DMARC?
Yes — SPF alignment fails on PermError. DMARC can still pass if DKIM aligns.