DMARC permerror (and 554 5.7.5): how to fix it

permerror in an email's headers means a receiver tried to check your domain and couldn't, because of something in your DNS that won't fix itself:

Authentication-Results: spf=permerror smtp.mailfrom=example.com;
 dkim=pass header.d=example.com; dmarc=permerror header.from=example.com

The DMARC standard defines it as "a permanent error occurred during DMARC evaluation, such as encountering a syntactically incorrect DMARC record." Unlike temperror, retrying won't help.

About "554 5.7.5 permanent error evaluating DMARC policy"

Some bounces quote this text. None of the large mailbox providers documents it: Gmail reports DMARC failures as 550 5.7.26, Microsoft as 550 5.7.509, and the standard meaning of 5.7.5 is "cryptographic failure". Treat it as a permerror from a smaller or custom mail system and work through the causes below.

The causes

SPF permerror

Most permerrors are really SPF's. SPF returns permerror when:

The record needs more than 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones inside other services' includes. See SPF "too many DNS lookups".
The domain has two SPF records. Two TXT records starting with v=spf1 is an error, not a merge. Combine them into one.
The record has a syntax error, such as a typo in a mechanism.

An SPF permerror doesn't always mean DMARC fails: DMARC still passes if DKIM passes for your domain. But it removes your backup, and some receivers treat it as a failure on its own.

DMARC record errors

Check the TXT record at _dmarc.example.com:

v=DMARC1 must come first, and p= right after it. A record without them is invalid.
There must be exactly one record. With two, receivers stop and apply no DMARC policy at all. Microsoft reports this as dmarc=permerror.
Other tags with bad values (a pct over 100, a rua without mailto:) should be ignored by receivers, but not every receiver is lenient.

A correct record looks like this:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

How to fix it

Look up your records. Run dig +short TXT example.com and dig +short TXT _dmarc.example.com. Count the v=spf1 and v=DMARC1 records: there should be one of each.
Count SPF lookups. If you're over 10, remove services you no longer use, and replace includes of a single fixed IP with ip4:.
Fix the DMARC syntax, starting from the record above.
Send a test to Gmail and Outlook.com and check that the headers now show pass for SPF, DKIM and DMARC.

DNS changes take up to the record's TTL to reach every receiver.

Check your domain

The SPF lookup counter counts lookups through every include, and the DMARC checker checks your DMARC record. The free scan runs both.

DMARC permerror: what it means and how to fix it