Error reference

Every failure state a checker or a bounce message can report, what causes it, and what to change.

SPF permerrorA permanent, unrecoverable problem in your SPF record. SPF is not failing "sometimes" — it is not working at all. SPF: too many DNS lookupsRFC 7208 caps an SPF evaluation at 10 DNS lookups. Past that, receivers return permerror and stop authenticating your mail entirely. Multiple SPF records foundRFC 7208 permits exactly one SPF record per name. Publishing two makes receivers return permerror and ignore both. SPF temperrorA transient DNS failure during SPF evaluation. Usually the receiver retries and the message is delivered. SPF softfail (~all)The sending server is not on your authorised list, but you are asking receivers to accept the mail anyway and mark it as suspicious. SPF hardfail (-all)The sending server is not authorised and you are asking receivers to reject the mail outright. SPF neutral (?all)Your record explicitly asserts nothing about unlisted senders — functionally the same as having no SPF record. SPF +all — the entire internet can send as youA record ending in +all authorises every server on the internet to send mail as your domain. SPF none — no record publishedThe domain publishes no SPF record, so receivers have no list of authorised senders. DMARC failNeither SPF nor DKIM produced a pass that aligned with the visible From: domain. DMARC p=none is doing nothingA p=none policy monitors and reports but blocks nothing. Spoofed mail using your domain is still delivered. No DMARC recordNothing published at _dmarc.yourdomain, so anyone can spoof the domain and you receive no reports about it. DKIM failA DKIM signature was present but did not verify against the published key. No DKIM signatureMail is leaving unsigned, so DMARC has only SPF to rely on — and SPF breaks whenever a message is forwarded. 550 5.7.26 — unauthenticated email from domain is not acceptedGmail rejected the message because it failed both SPF and DKIM alignment. This is a hard bounce, not a spam-folder placement. 550 5.7.1 — message rejected by policyA generic policy rejection. The accompanying text says which policy fired — most often DMARC, SPF, or a recipient-side rule. Google and Yahoo bulk sender requirementsSince February 2024, senders posting more than 5,000 messages a day to Gmail or Yahoo must authenticate with SPF and DKIM, publish DMARC, offer one-click unsubscribe, and stay under a 0.3% spam complaint rate. SPF void lookup limit exceededRFC 7208 allows at most two DNS lookups that return nothing. A third makes the whole record permerror.