Permanent error in processing during lookup

SPF Permerror and SPF Temperror – How To Quickly Fix Your SPF Errors

SPF permerror is a crucial and most common one among such errors.

EMAIL SECURITY SERVICES

PLANS AND PRICING

SPF RECORDS

SPF permerror is a standard error and the most common one, among other SPF authentication errors that can result in non-delivery of emails. To resolve the errors, one must first have a clear idea of what these errors are and why such errors occur, making it easier to resolve them.

Table of Contents

The Most Common SPF Errors

DMARC (Domain-based Message Authentication, Reporting, and Conformance) identifies and categorizes the possible SPF fails. Here are some of the SPF non-pass errors.

• none: Unable to resolve domain name or find SPF record in the domain
• neutral: The domain does not explicitly state that the IP address is authorized
• fail (hard fail): The client is not allowed to use the domain
• fail (soft fail): The host is probably not authorized
• temperror (Temporary error): SPF encountered a transient error like DNS timeout
• permerror (Permanent error): Inability to correctly interpret the domain’s published records.

What Is SPF PermError?

SPF permerror or ‘SPF Permanent Error’ is one of the common SPF errors that call for immediate resolution for emails to have higher deliverability. It signifies that DMARC could not correctly interpret the domain’s published records, and signals an error condition that requires immediate DNS intervention to be resolved. SPF permerror can occur because of any of the following reasons.

• If there are multiple SPF records on one domain
• If the SPF record has a syntax error
• If an SPF checking process lists out more than 10 DNS lookups

The most common SPF permerror is related to the third parameter, i.e., ‘too many DNS lookups.’ Let us understand what it means.

What Is SPF Permerror – Too Many DNS Lookups?

Limiting the number of DNS lookups is one of the significant safeguards put in place with SPF to avoid timeout issues. As a rule, SPF evaluates a maximum of 10 DNS mechanism lookups in an SPF record. These mechanisms include a, mx, ptr, exists, include, and redirect. If the DNS lookups exceed 10, it raises an SPF permerror. If you encounter an SPF permerror, you would have to remove some of the current mechanisms/lookups.

How Do You Avoid Encountering The Error Of 10 DNS Lookup Limit?

There are numerous ways to avoid SPF permerror – too many DNS lookups, as listed below.

Avoid unnecessary ‘include’ statements

The role of the include statement in an SPF record is to redirect DNS lookup to another domain’s SPF record for verifying any of their authorized IPs. The number of include statements in the original SPF record or the redirected ones should not exceed 10.

Use of ip4 and ip6 mechanisms

Replace the include statement with ip4 and ip6 mechanisms if possible. They are used to list a static IP range in the SPF record. It eliminates the necessity of an include statement that references another domain’s SPF record.

Remove mechanisms referring to the same domain

Removing mechanisms that refer to the same domain can avoid unnecessary DNS lookups.

Avoid ptr mechanisms

SPF recommendations caution against the use of the ptr mechanism in an SPF record. This DNS record links an IP address to a domain. Avoiding the ptr mechanism is better because it can result in a large number of DNS lookups.

Removal of legacy partner and vendor domains

One must remove all include statements that redirect SPF record check to vendors or partners who do not send emails on their behalf. Such removal eliminates unnecessary DNS lookups.

One should reference actively sending domains

One should ensure that the referenced domains are active ones. Otherwise, should consider removing them.

Perform SPF record checks

A robust SPF record checking tool can also help you diagnose whether your SPF record is over the 10-lookup limit.

We have seen the concept of SPF permerror and learned how to resolve the ‘too many DNS lookups’ issue. Let us now consider the difference between SPF temperror and SPF permerror.

SPF TempError vs. PermError

SPF temperror is a temporary error that usually doesn’t require much user intervention to solve. It usually goes away by itself. It can occur during the SPF verification process. An error like a DNS timeout is an example of an SPF temperror, whereas more than 10 DNS lookups can result in SPF permerror. If you don’t encounter SPF temperror from multiple mailboxes, you can conclude there are no DNS configuration problems with your domain and SPF record.

Email deliverability is crucial to maintain customer trust and business reputation. Errors in SPF authentication can fail to deliver emails, leading to business communication issues. As discussed above, SPF permerror is one of the crucial SPF errors that require immediate attention. Resolving such errors in time can help in having better SPF authentication, and resultantly better email deliverability.

Источник

permanent error in processing during lookup of my@domain.com: 23.83.214.30 not found

Here is the error upon receiving the email using domain’s email account.

Received-SPF: permerror (google.com: permanent error in processing during lookup of email@domain.com: 23.83.214.30 not found) client-ip=46.232.183.183; Authentication-Results: mx.google.com; spf=permerror (google.com: permanent error in processing during lookup of email@domain.com: 23.83.214.30 not found) smtp.mailfrom=email@domain.com

My SPF record v=spf1 +a +mx +ip4:119.81.160.218

Also, everytime I use the domain’s email account for sending an email, red question mark appears instead of profile photo.

Mail Header

2 Answers 2

23.83.214.30 is the IP address of MailChannels SMTP relay service. If you are using a relay service, you will need to include them in your SPF record.

The SPF record for your-domain.com should include IPs of any servers sending mail on its behalf. See https://mailchannels.zendesk.com/hc/en-us/articles/200262610-SPF-Records-Configuration-for-MailChannels-Cloud for configuration information.

It’s possible these IP addresses are already included, but it’s not possible to tell from what you listed. Your current SPF record includes the A records for your-domain.com, the IPs/servers found through MX records of your-domain.com and the IP address ‘119.81.160.218’ (presumably your server, but this is likely the same as the A record).

Posting full mail headers and your domain name would be helpful in verifying how records are setup.

Источник

SPF Record — Sender server SPF record permerror

I cannot seem to get a SPF record working for a client of ours, Google mail keeps failing on the lookup.

My SPF record is

v=spf1 a ip4:80.74.254.215 include:mx1.helloevery1.co.uk include:_spf.google.com include:smtproutes.com include:smtpout.com

The clients main mail server are

These are working fine, SPF passes as expected.

mx1.helloevery1.co.uk is our mail server. It is a simple ISPConfig Postfix setup. We send all mail through 1 account, let’s say that is «noreply@example.com».

There is a username and password set up to send through but we change the «from» address in our application. The from address is «enquiry@clientdomain.com».

«enquiry@clientdomain.com» is not set up on mx1.helloevery1.co.uk. It is only on the client servers.

When I send through my SMTP server from the site, I am receiving the following error when I send to my email account.

Received-SPF: permerror (google.com: permanent error in processing during lookup of enquiry@clientdomain.com) client-ip=212.71.234.103;

Authentication-Results: mx.google.com; spf=permerror (google.com: permanent error in processing during lookup of enquiry@clientdomain.com) smtp.mail=enquiry@clientdomain.com

This looks like it is trying to lookup the domain on my SMTP server (where is not is configured). If I were to set up the domain on my SMTP server and create an account then when I send through my SMTP server then it will try to deliver it locally.

I’ve always assumed that SPF was just a verification tool to say which server is allowed to send but never really took into account the email it is coming from.

I’m stuck as I can’t find a resource on SPF record creation that I can relate to

Источник

spf=permerror

Hey all, having fun with SPF records and getting this error with google and I assume others. MXtoolbox says it is good.

spf=permerror (google.com: permanent error in processing during lookup of swilkins@centra.ca: mail.centrawindows.com not found) smtp.mailfrom=swilkins@centra.ca; dmarc=fail (p=QUARANTINE sp=REJECT dis=QUARANTINE) header.from=centra.ca

This is our spf record.

v=spf1 a mx include:mail.centrawindows.com include:reflexion.net include:meighen.smartt.com include:servers.mcsv.net include:in.constantcontact.com include:spf.constantcontact.com include:mail.zendesk.com

Any insight is appreciated.

Popular Topics in Email

EBS Computer Services is an IT service provider.

Well the error message says that mail.centrawindows.com is not found, so I’d start there.

OK — there’s no SPF record at mail.centrawindows.com, but the A record suggest that it’s your mail server.

In that case, include: is the wrong thing to use. If you want to allow the IP address designated by a DNS A record, then it should be a:mail.centrawindows.com

EBS Computer Services is an IT service provider.

Well the error message says that mail.centrawindows.com is not found, so I’d start there.

Well the error message says that mail.centrawindows.com is not found, so I’d start there.

I don’t understand how it is not found? DNS is resolving correctly.

EBS Computer Services is an IT service provider.

Well the error message says that mail.centrawindows.com is not found, so I’d start there.

OK — there’s no SPF record at mail.centrawindows.com, but the A record suggest that it’s your mail server.

In that case, include: is the wrong thing to use. If you want to allow the IP address designated by a DNS A record, then it should be a:mail.centrawindows.com

EBS Computer Services is an IT service provider.

«Include» in an SPF record means «Look up the SPF record for the following domain and include that in mine.»

JoeWilliams wrote:JoeWilliams wrote:

Well the error message says that mail.centrawindows.com is not found, so I’d start there.

OK — there’s no SPF record at mail.centrawindows.com, but the A record suggest that it’s your mail server.

In that case, include: is the wrong thing to use. If you want to allow the IP address designated by a DNS A record, then it should be a:mail.centrawindows.com

Ok, that makes more sense. I will try the changes and report back.

Strange, maybe you send from another location IP Address then. Your SPF looks good though.

Strange, maybe you send from another location IP Address then. Your SPF looks good though.

Although the A record should be a domain and not a subdomain:

Strange, maybe you send from another location IP Address then. Your SPF looks good though.

Although the A record should be a domain and not a subdomain:

No it makes sense I want it to be the ip so a:mail.domain.com would be what I need to change it to.

Looks like that was the issue Thanks for your help! Noticed we had a couple of includes that should have been A: records.

This topic has been locked by an administrator and is no longer open for commenting.

To continue this discussion, please ask a new question.

Read these next.

poor wifi, school’s third floor

I work as a help desk technician at a high school for a school district. Teachers/students on the building’s third floor have been reporting poor wifi, with their Chromebooks/laptops etc experiencing slow connectivity and random disconnections. We hav.

Need help crafting a job posting for an IT Pro

I’d really appreciate some thoughts and advice. I’m looking to hire an IT pro to be our resident go-to for all things IT (device support, SQL Server, network admin, etc) but who also is interested in learning — or even has some experience in — the.

Snap! — AI Eye Contact, Mine Batteries, Headset-free Metaverse, D&D Betrayal

Your daily dose of tech news, in brief. Welcome to the Snap! Flashback: January 13, 1874: Adding Machine Patented (Read more HERE.) Bonus Flashback: January 13, 1990: Astronauts awakened to the song Attack of the Killer Tomatoes (Read mor.

Spark! Pro series – 13th January 2023

Happy Friday the 13th! This day has a reputation for being unlucky, but I hope that you’ll be able to turn that around and have a great day full of good luck and good fortune. Whether you’re superstitious or not, .

Источник

The Most Common SPF Errors

DMARC (Domain-based Message Authentication, Reporting, and Conformance) identifies and categorizes the possible SPF fails. Here are some of the SPF non-pass errors.

• none: Unable to resolve domain name or find SPF record in the domain
• neutral: The domain does not explicitly state that the IP address is authorized
• fail (hard fail): The client is not allowed to use the domain
• fail (soft fail): The host is probably not authorized
• temperror (Temporary error): SPF encountered a transient error like DNS timeout
• permerror (Permanent error): Inability to correctly interpret the domain’s published records.

What Is SPF PermError?

SPF permerror or ‘SPF Permanent Error’ is one of the common SPF errors that call for immediate resolution for emails to have higher deliverability. It signifies that DMARC could not correctly interpret the domain’s published records, and signals an error condition that requires immediate DNS intervention to be resolved. SPF permerror can occur because of any of the following reasons.

• If there are multiple SPF records on one domain
• If the SPF record has a syntax error
• If an SPF checking process lists out more than 10 DNS lookups

The most common SPF permerror is related to the third parameter, i.e., ‘too many DNS lookups.’ Let us understand what it means.

What Is SPF Permerror – Too Many DNS Lookups?

Limiting the number of DNS lookups is one of the significant safeguards put in place with SPF to avoid timeout issues. As a rule, SPF evaluates a maximum of 10 DNS mechanism lookups in an SPF record. These mechanisms include a, mx, ptr, exists, include, and redirect. If the DNS lookups exceed 10, it raises an SPF permerror. If you encounter an SPF permerror, you would have to remove some of the current mechanisms/lookups.

How Do You Avoid Encountering The Error Of 10 DNS Lookup Limit?

There are numerous ways to avoid SPF permerror – too many DNS lookups, as listed below.

Avoid unnecessary ‘include’ statements

The role of the include statement in an SPF record is to redirect DNS lookup to another domain’s SPF record for verifying any of their authorized IPs. The number of include statements in the original SPF record or the redirected ones should not exceed 10.

Use of ip4 and ip6 mechanisms

Replace the include statement with ip4 and ip6 mechanisms if possible. They are used to list a static IP range in the SPF record. It eliminates the necessity of an include statement that references another domain’s SPF record.

Remove mechanisms referring to the same domain

Removing mechanisms that refer to the same domain can avoid unnecessary DNS lookups.

Avoid ptr mechanisms

SPF recommendations caution against the use of the ptr mechanism in an SPF record. This DNS record links an IP address to a domain. Avoiding the ptr mechanism is better because it can result in a large number of DNS lookups.

Removal of legacy partner and vendor domains

One must remove all include statements that redirect SPF record check to vendors or partners who do not send emails on their behalf. Such removal eliminates unnecessary DNS lookups.

One should reference actively sending domains

One should ensure that the referenced domains are active ones. Otherwise, should consider removing them.

Perform SPF record checks

A robust SPF record checking tool can also help you diagnose whether your SPF record is over the 10-lookup limit.

We have seen the concept of SPF permerror and learned how to resolve the ‘too many DNS lookups’ issue. Let us now consider the difference between SPF temperror and SPF permerror.

SPF TempError vs. PermError

SPF temperror is a temporary error that usually doesn’t require much user intervention to solve. It usually goes away by itself. It can occur during the SPF verification process. An error like a DNS timeout is an example of an SPF temperror, whereas more than 10 DNS lookups can result in SPF permerror. If you don’t encounter SPF temperror from multiple mailboxes, you can conclude there are no DNS configuration problems with your domain and SPF record.

Email deliverability is crucial to maintain customer trust and business reputation. Errors in SPF authentication can fail to deliver emails, leading to business communication issues. As discussed above, SPF permerror is one of the crucial SPF errors that require immediate attention. Resolving such errors in time can help in having better SPF authentication, and resultantly better email deliverability.

Что такое perm error

Hey Matt, thank you for getting back so quickly. Here is the top of the response . (But I’ll also attach a screen shot of it which may be easier to look at.)

. Everything below here is from the Perm Error .

Delivery to the following recipients failed permanently:

Reason: Permanent Error

Reporting-MTA: dns; resqmta-po-04v.sys.comcast.net [96.114.154.163] Received-From-MTA: dns; resomta-po-12v.sys.comcast.net [96.114.154.236] Arrival-Date: Mon, 04 Jul 2016 21:02:33 +0000

Final-recipient: rfc822; dbiggers@comcaset.net Diagnostic-Code: smtp; Last-attempt-Date: Mon, 04 Jul 2016 21:03:34 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1467666153; bh=g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=; h=Received:Received:To:From:Subject:Message-ID:Date:MIME-Version: Content-Type; b=kYZZKUj0Jy4yC817njwDD1m1qFiEw5b95tMnSA1IafAY4S4q/5DtfLWTGhgwWrArt dFYqX7XSxWoz+Jz9iHdPuaXra2Tt8MTBKFIRyB26HG36GXGR1lRr03j7J5hVTwssMF 1IFEyIBVvJd+ZJ08wx6AKg372w/qGpX146W9lFvkHFdGGTtJRAGRbBZt7s31T6ylyV s/tv3+T/+cwyoo+poijcfSsOFKZNSd5BODMfQVrQ/noZjVB55r3w5+oNJgNRmDVvz0 /V8xNJ7MfS7Z832E82iA9sXZ+z9rvw2cZu2Y237juqe3aVfDqSmKbPhawaJ/dnXwXw OMjBMY8iuV9Dg== Received: from [IPv6:2601:644:8002:83b0:34d9:7b28:e1ff:b04a] ([IPv6:2601:644:8002:83b0:34d9:7b28:e1ff:b04a]) by resomta-po-12v.sys.comcast.net with comcast id El2Y1t00Y013bjE01l2ZJs; Mon, 04 Jul 2016 21:02:33 +0000 X-CAA-SPAM: 0 X-Authority-Analysis: v=2.1 cv=U5Bvdrfu c=1 sm=1 tr=0 a=IkcTkHD0fZMA:10

To: dbiggers@comcaset.net From: Dave Biggers Subject: test Message-ID: Date: Mon, 4 Jul 2016 14:02:34 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101

MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit

Источник

SPF Permerror and SPF Temperror – How To Quickly Fix Your SPF Errors

SPF permerror is a crucial and most common one among such errors.

EMAIL SECURITY SERVICES

PLANS AND PRICING

SPF RECORDS

SPF permerror is a standard error and the most common one, among other SPF authentication errors that can result in non-delivery of emails. To resolve the errors, one must first have a clear idea of what these errors are and why such errors occur, making it easier to resolve them.

Table of Contents

The Most Common SPF Errors

DMARC (Domain-based Message Authentication, Reporting, and Conformance) identifies and categorizes the possible SPF fails. Here are some of the SPF non-pass errors.

• none: Unable to resolve domain name or find SPF record in the domain
• neutral: The domain does not explicitly state that the IP address is authorized
• fail (hard fail): The client is not allowed to use the domain
• fail (soft fail): The host is probably not authorized
• temperror (Temporary error): SPF encountered a transient error like DNS timeout
• permerror (Permanent error): Inability to correctly interpret the domain’s published records.

What Is SPF PermError?

SPF permerror or ‘SPF Permanent Error’ is one of the common SPF errors that call for immediate resolution for emails to have higher deliverability. It signifies that DMARC could not correctly interpret the domain’s published records, and signals an error condition that requires immediate DNS intervention to be resolved. SPF permerror can occur because of any of the following reasons.

• If there are multiple SPF records on one domain
• If the SPF record has a syntax error
• If an SPF checking process lists out more than 10 DNS lookups

The most common SPF permerror is related to the third parameter, i.e., ‘too many DNS lookups.’ Let us understand what it means.

What Is SPF Permerror – Too Many DNS Lookups?

Limiting the number of DNS lookups is one of the significant safeguards put in place with SPF to avoid timeout issues. As a rule, SPF evaluates a maximum of 10 DNS mechanism lookups in an SPF record. These mechanisms include a, mx, ptr, exists, include, and redirect. If the DNS lookups exceed 10, it raises an SPF permerror. If you encounter an SPF permerror, you would have to remove some of the current mechanisms/lookups.

How Do You Avoid Encountering The Error Of 10 DNS Lookup Limit?

There are numerous ways to avoid SPF permerror – too many DNS lookups, as listed below.

Avoid unnecessary ‘include’ statements

The role of the include statement in an SPF record is to redirect DNS lookup to another domain’s SPF record for verifying any of their authorized IPs. The number of include statements in the original SPF record or the redirected ones should not exceed 10.

Use of ip4 and ip6 mechanisms

Replace the include statement with ip4 and ip6 mechanisms if possible. They are used to list a static IP range in the SPF record. It eliminates the necessity of an include statement that references another domain’s SPF record.

Remove mechanisms referring to the same domain

Removing mechanisms that refer to the same domain can avoid unnecessary DNS lookups.

Avoid ptr mechanisms

SPF recommendations caution against the use of the ptr mechanism in an SPF record. This DNS record links an IP address to a domain. Avoiding the ptr mechanism is better because it can result in a large number of DNS lookups.

Removal of legacy partner and vendor domains

One must remove all include statements that redirect SPF record check to vendors or partners who do not send emails on their behalf. Such removal eliminates unnecessary DNS lookups.

One should reference actively sending domains

One should ensure that the referenced domains are active ones. Otherwise, should consider removing them.

Perform SPF record checks

A robust SPF record checking tool can also help you diagnose whether your SPF record is over the 10-lookup limit.

We have seen the concept of SPF permerror and learned how to resolve the ‘too many DNS lookups’ issue. Let us now consider the difference between SPF temperror and SPF permerror.

SPF TempError vs. PermError

SPF temperror is a temporary error that usually doesn’t require much user intervention to solve. It usually goes away by itself. It can occur during the SPF verification process. An error like a DNS timeout is an example of an SPF temperror, whereas more than 10 DNS lookups can result in SPF permerror. If you don’t encounter SPF temperror from multiple mailboxes, you can conclude there are no DNS configuration problems with your domain and SPF record.

Email deliverability is crucial to maintain customer trust and business reputation. Errors in SPF authentication can fail to deliver emails, leading to business communication issues. As discussed above, SPF permerror is one of the crucial SPF errors that require immediate attention. Resolving such errors in time can help in having better SPF authentication, and resultantly better email deliverability.

Источник

Что такое perm error

Hey Matt, thank you for getting back so quickly. Here is the top of the response . (But I’ll also attach a screen shot of it which may be easier to look at.)

. Everything below here is from the Perm Error .

Delivery to the following recipients failed permanently:

Reason: Permanent Error

Reporting-MTA: dns; resqmta-po-04v.sys.comcast.net [96.114.154.163] Received-From-MTA: dns; resomta-po-12v.sys.comcast.net [96.114.154.236] Arrival-Date: Mon, 04 Jul 2016 21:02:33 +0000

Final-recipient: rfc822; dbiggers@comcaset.net Diagnostic-Code: smtp; Last-attempt-Date: Mon, 04 Jul 2016 21:03:34 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1467666153; bh=g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=; h=Received:Received:To:From:Subject:Message-ID:Date:MIME-Version: Content-Type; b=kYZZKUj0Jy4yC817njwDD1m1qFiEw5b95tMnSA1IafAY4S4q/5DtfLWTGhgwWrArt dFYqX7XSxWoz+Jz9iHdPuaXra2Tt8MTBKFIRyB26HG36GXGR1lRr03j7J5hVTwssMF 1IFEyIBVvJd+ZJ08wx6AKg372w/qGpX146W9lFvkHFdGGTtJRAGRbBZt7s31T6ylyV s/tv3+T/+cwyoo+poijcfSsOFKZNSd5BODMfQVrQ/noZjVB55r3w5+oNJgNRmDVvz0 /V8xNJ7MfS7Z832E82iA9sXZ+z9rvw2cZu2Y237juqe3aVfDqSmKbPhawaJ/dnXwXw OMjBMY8iuV9Dg== Received: from [IPv6:2601:644:8002:83b0:34d9:7b28:e1ff:b04a] ([IPv6:2601:644:8002:83b0:34d9:7b28:e1ff:b04a]) by resomta-po-12v.sys.comcast.net with comcast id El2Y1t00Y013bjE01l2ZJs; Mon, 04 Jul 2016 21:02:33 +0000 X-CAA-SPAM: 0 X-Authority-Analysis: v=2.1 cv=U5Bvdrfu c=1 sm=1 tr=0 a=IkcTkHD0fZMA:10

To: dbiggers@comcaset.net From: Dave Biggers Subject: test Message-ID: Date: Mon, 4 Jul 2016 14:02:34 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101

MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit

Источник

Что такое perm error

Доброго всем коллеги!

Подскажите пож-та, что может быть не так.

Имеется Exchange 365. Все было хорошо. Вчера пришлось менять DNS хостинг для нашего домена. Перенесли с DNS хостинга с которого ушли все днс записи на новый DNS хостинг. (А, MX, Cname, TXT и т.п.) При проверке домена на ошибки в днс, Exchange говорит = Все ок!

Вопрос теперь к SPF записи. На старом ДНС хостинге она была такой:

@ IN TXT v=spf1 include:spf. .com include:spf.protection.outlook.com -all

В таком же виде запись переехала на новый днс хостинг.

Начали все тестить и проверять. И если послать себе письмо на Gmail, то письмо приходит. Но открыв раздел в Gmail «Показать оригинал» (чтобы посмотреть результаты проверок и заголовки), Gmail показывает, что DKIM=pass, Dmarc=pass, SPF=Permerror.

Вчера не знал что с этим делать и привел запись к виду:

@ IN TXT «v=spf1 include:spf.protection.outlook.com -all

После этого, постоянная ошибка Permerror ушла и была такая картина:

Шлешь себе на Gmail письмо, проверяешь — ошибка есть. Через 3-5 минут шлешь новое письмо ошибки нет. Опять через 10 минут шлешь — ошибка и, чуть позже — нет ошибки. Тем более почти в каждом новом письме IP отправителя разные. Так ведь работает Exchange 365, там же у MS много почтовых серверов в пуле или в этом кластере под O365.

Сегодня с утра пришел на работу, начал снова проверять. Больше ошибки не увидел. Все было ок! Может такое плавающее состояние было вызвано задержкой в синхронизации информации по ДНС?

И вот сейчас я решил снова вернуть SPF запись к ее изначальному состоянию:

@ IN TXT v=spf1 include:spf. .com include:spf.protection.outlook.com -all

И опять Permerror. То ли подождать пока синхронизация ДНС пройдет и все наладится, толи это все таки ошибка. Но на старом ДНС хостинге не было такой истории с этой записью. (

Я так полагаю, бывший админ сделал еще один блок include spf. .com для того, чтобы с нашего сайта работала форма обратной связи. К ней привязан почтовый ящик из нашего домена. Может не для этого. история умалчивает.

Источник

SPF perm error question.

Good afternoon Spiceheads,

I have an odd issue where one of my users is getting a permerror for SPF when receiving some e-mails. The one I example I have currently is from a calendar invite sent to an address that forwards to the user. Part of the e-mail he received when it is sent to him is below:

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@z.com header.s=google header.b=hm1//a3E;

spf=permerror (google.com: permanent error in processing during lookup of m@z.com: cloud.opensymbol.it not found) smtp.mailfrom=m@z.com

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id x18-v6sor9060852oth.107.2018.06.01.12.51.39

(Google Transport Security);

Fri, 01 Jun 2018 12:51:39 -0700 (PDT)

Received-SPF: permerror (google.com: permanent error in processing during lookup of m@z.com: cloud.opensymbol.it not found) client-ip=209.85.220.41;

dkim=pass header.i=@z.com header.s=google header.b=hm1//a3E;

spf=permerror (google.com: permanent error in processing during lookup of m@z.com: cloud.opensymbol.it not found) smtp.mailfrom=m@z.com

We are currently using G Suite. Multiple users received the calendar invite with no issues. When he uses Outlook we receive the email with the above error. When we open Gmail the emails display with no issues. I’ve attempted to do research and play around with settings in Outlook to no avail — can someone help point me in the correct direction?

Enter to win a Win $150 GC and Binho Board set, or Intel® Pins

It’s an issue with the sender. They have two SPF records. One of which is for an amazon hostname (cloud.opensymbol.it).

The issue is that one is a hardfail record. (-all instead of

That one user is likely hitting a service that is tagging that one SPF record. Gmail to gmail (internally) isn’t going to look at the SPF record, since the mail won’t ever transit to the outside world, it stays internal to the gmail system.

At the end of the day, 1. That 2 SPF record thing is going to (potentially) cause all kinds of weird issues and 2. There’s not a damn thing you can do about it if you don’t manage that domain. Let the sender know they have some SPF issues and to engage their email admins

7 Replies

You can only have 1 SPF record for the domain. Try something like:

I dont even understand who the sender is or the recipient in this case

Are z.com and w.com the actual domains or have you changed them, is so the latter is consuming.

Is opensymbol.it your actual domain (sender or recipients)

I dont see an SPF record for opensymbol.it if it is

I have changed them. z.com is the sender and w.com is the recipient. The recipient is the end user I am working with. It looks like opensymbol.it is tied to the sender. However, other people within the organization, including myself, are able to receive e-mails from the sender with no issues. Additionally, the receiver can open the e-mail in Gmail with no issues — the e-mails are only showing the error text in Outlook 2016 and that is where I’m getting thrown off a bit.

So to re-iterate — this is impacting a single user in Outlook 2016. I would expect, based on the error generated, more users to be impacted but that could also be a knowledge gap on my end as well.

I would recommend running your domain through http://www.kitterman.com/spf/validate.html Opens a new window — to see if your SPF record is correct or not. From the error, «spf=permerror (google.com: permanent error in processing during lookup of m@z.com: cloud.opensymbol.it not found)» it tells me that «@z.com» needs to update their SPF record as it may not have Cloud.opensymbol.it authorized to send on the domains behalf.

I put mx toolbox as you may want to check if there is any blacklist information for go daddy I think you need to check it before raising a request with them but once you do their response gives you an indication oif whether there are any issues prior to completing the removal request.

It’s an issue with the sender. They have two SPF records. One of which is for an amazon hostname (cloud.opensymbol.it).

The issue is that one is a hardfail record. (-all instead of

That one user is likely hitting a service that is tagging that one SPF record. Gmail to gmail (internally) isn’t going to look at the SPF record, since the mail won’t ever transit to the outside world, it stays internal to the gmail system.

At the end of the day, 1. That 2 SPF record thing is going to (potentially) cause all kinds of weird issues and 2. There’s not a damn thing you can do about it if you don’t manage that domain. Let the sender know they have some SPF issues and to engage their email admins

This topic has been locked by an administrator and is no longer open for commenting.

To continue this discussion, please ask a new question.

Read these next.

Snap! — Flying Boats, Metaverse Vision, Floppy Disks in 2023, Replicated Cheese

Your daily dose of tech news, in brief. Welcome to the Snap! Flashback: January 12, 1997: HAL 9000 Becomes Operational (Read more HERE.) Bonus Flashback: January 12, 2005: NASA launched «Deep Impact» (Read more HERE.) You need to hear .

Spark! Pro Series — 12 January 2023

Today in History: 1984 Pyramid mystery unearthed An international panel overseeing the restoration of the Great Pyramids in Egypt overcomes years of frustration when it abandons modern construction techniques in favor of the method employed by .

Managing confidential/PII data in a non profit environment

I am looking for some suggestions on how manage confidential and Personally Identifiable Information in our non profit environment. We run a number of grant programs that require applicants to upload tax documentation, IDs, and other financial information.

What would you pay / How much do you charge to detangle a network rack?

I work for an MSP and we constantly run into rats nests in the network rooms of our clients. I was wondering what it would be worth to turn these rates nests into neatly organized network racks. I know that the price would vary widely by job and area bu.

User Account Getting Locked Out

We have a user that continually has their account locked out. There are times where she gets up from her computer and locks it, only to come back a short while later to login and she’ll be locked out. I’ve looked in the event viewer on the DC but it doesn.

Источник

When the SPF record on a domain can’t be correctly interpreted, SPF returns a PermError (permanent error). In contrast with an SPF TempError (temporary error), an SPF PermError requires a system administrator to take measures to rectify the issue.

Here is a list of causes of SPF PermError:

• multiple SPF records are found on one domain;
• the SPF record is syntactically incorrect;
• the number of DNS lookups involved in a single SPF check exceeds 10;
• the number of void lookups involved in a single SPF check exceeds 2;
• there is an exception in redirect.

We will go through these scenarios in this article one by one.

Multiple SPF records are found on one domain

Only one SPF record can be published on a domain or a subdomain; otherwise SPF returns a PermError. Learn more here: Can I Have Multiple SPF Records on My Domain?

For example, if you publish 2 completely valid SPF records on domain.com, SPF fails with a PermError for this reason:

v=spf1 a -all

v=spf1 mx -all

The solution to this problem is to keep only one valid SPF record with all the necessary mechanisms. For example, if both the a and mx mechanisms are required, you can update the first SPF record to:

v=spf1 a mx -all

and remove the second SPF record, then the issue is fixed.

The SPF record is syntactically incorrect

Your SPF record must be syntactically correct, otherwise SPF returns a PermError.

For example, there is an invalid mechanism in the following SPF record:

v=spf1 a im -all

As no im mechanism is defined in the SPF specification, it’s considered an invalid mechanism; therefore, the SPF record is syntactically incorrect.

To fix it, update im with a valid SPF mechanism or remove it altogether, depending on your actual needs.

The number of DNS lookups involved in a single SPF check exceeds 10

When SPF evaluates the SPF record on a domain, the number of mechanisms and modifiers that do DNS lookups must not exceed 10 per SPF check, including any lookups caused by the use of the «include» mechanism or the «redirect» modifier; otherwise, SPF returns a PermError.

For example, if a domain has an SPF record like this:

v=spf1 a mx include:bluehost.com ?all

SPF can fail with a PermError, as bluehost.com already contains 13 DNS lookups and that mechanism alone violates the 10-DNS-lookup limit in SPF.

You can use DMARCLY’s free SPF Record Checker to check your SPF record for this issue.

To fix it, use DMARCLY’s Safe SPF.

Refer to SPF PermError: Too Many DNS Lookups for more information.

The number of void lookups involved in a single SPF check exceeds 2

During an SPF check, if it’s unable to resolve the DNS host for a mechanism/modifier in the SPF record, it’s called a «void lookup». These mechanisms can be the «include», «a», «mx», «ptr», and «exists» mechanisms, and the «redirect» modifier.

SPF fails with a PermError if the number of void lookups involved in a single SPF check exceeds 2.

For example, if none of badhost1, badhost2, and badhost3 exists, and you have an SPF record as shown below:

v=spf1 a:badhost1 include:badhost2 exists:badhost3 -all

SPF will fail with a PermError, as the number of void lookups in the above record is 3.

To avoid this, either publish valid SPF records on those hosts, or remove them.

There is an exception in redirect

If a «redirect» mechanism is used in an SPF record, the target name of the mechanism must have an SPF record, otherwise SPF fails with a PermError.

For example, if your SPF record looks like this:

v=spf1 redirect=_spf.example.com

And if there is no SPF record on _spf.example.com, SPF fails with a PermError.

To avoid this, make sure your redirect mechanism points to a target name with a valid SPF record on it. In the case above, publish an SPF record on _spf.example.com.

To learn more about SPF authentication results, refer to Why SPF Authentication Fails.