SPF failures mean receiving servers can't verify your emails are from authorized sources. This guide covers the most common SPF errors and how to resolve them.
SPF Error Types
SPF Fail (-all violated)
The sending IP is explicitly not authorized.
- Check if sender is missing from your SPF record
- Add the sender's include or IP
SPF SoftFail (~all violated)
The sending IP is probably not authorized.
- Similar to fail, but less strict
- Often treated as suspicious but delivered
SPF PermError
Permanent error—SPF couldn't be evaluated.
- Usually means too many DNS lookups (>10)
- Or syntax error in SPF record
SPF TempError
Temporary error—DNS lookup failed.
- DNS server issues
- Usually resolves itself
Common SPF Problems
1. Too Many DNS Lookups
Error: PermError, "Too many DNS lookups"
Cause: SPF record exceeds 10 lookup limit
Solutions:
- Count your lookups (include, a, mx each count)
- Remove unused services
- Replace includes with IP addresses where possible
- Use SPF flattening tools
- Consider subdomain delegation
2. Multiple SPF Records
Error: PermError or inconsistent results
Cause: More than one TXT record starting with v=spf1
Solution: Combine into single record; delete duplicates
3. Missing Sending Service
Error: SPF fail for specific emails
Cause: Service not included in SPF record
Solution: Add the service's include statement
4. Syntax Errors
Error: PermError or record not recognized
Common syntax issues:
- Missing
v=spf1at start - Typos in mechanism names
- Invalid IP addresses
- Missing spaces between mechanisms
5. Wrong Record Location
Error: SPF record not found
Cause: Record at subdomain instead of root, or wrong TXT record
Solution: Publish at domain root (@)
Diagnosing SPF Failures
Check Your Record
dig TXT yourdomain.com
Look for a record starting with v=spf1
Use SPF Validators
- MxToolbox SPF Checker
- Kitterman SPF Validator
- dmarcian SPF Surveyor
Check Email Headers
Look for spf=pass or spf=fail in Authentication-Results
Fixing the 10 Lookup Limit
Count Your Lookups
Each of these counts as 1+ lookups:
-
include:- 1 + nested lookups -
a- 1 -
mx- 1 -
redirect=- lookups in target
Reduce Lookups
- Remove services you no longer use
- Replace
aandmxwithip4: - Flatten includes to IP addresses
- Use subdomains for different services
SPF Flattening
Replace includes with their resolved IPs. Example:
Before: include:_spf.google.com
After: ip4:35.190.247.0/24 ip4:64.233.160.0/19 ...
Caution: Flattened records need updating when provider IPs change.
Best Practices
- Start with ~all (softfail) while testing
- Validate before publishing changes
- Document all included services
- Review and update quarterly
- Monitor DMARC reports for SPF failures
For complete SPF setup, see our SPF creation guide.
0 comments