SPF include points at a domain with no SPF record — a silent PermError
When a receiver evaluates `include:vendor.example`, it performs a full SPF check on that domain. RFC 7208 §5.2 says that if the check returns None — no SPF record at all, or NXDOMAIN — the include mechanism returns PermError, and PermError aborts the whole evaluation.
The failure is invisible from the outside. Your own record still looks correct, and the vendor domain still resolves; it simply stopped publishing SPF, or was never publishing it. This most often happens when a vendor sunsets a product, renames their SPF hostname, or when a setup guide was followed with a typo in the include target.
Because the error is permanent rather than temporary, receivers do not retry. Every message that relies on SPF for DMARC alignment starts failing at once.
How to fix it
- 1Identify which include target has no SPF record — the report names it.
- 2If you no longer use that service, delete the include entirely. This is the usual answer.
- 3If you do still use it, check the vendor documentation for the current include hostname; vendors rename these more often than you would expect.
- 4Watch for typos in the hostname — a single wrong character produces exactly this failure.
- 5Re-scan and confirm no PermError targets remain.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored
- Multiple SPF records on one domain (PermError) — how to merge them