# DMARC permerror: what it means and how to fix it

`permerror` in an email's headers means a receiver tried to check your
domain and couldn't, because of something in your DNS that won't fix
itself:

```
Authentication-Results: spf=permerror smtp.mailfrom=example.com;
 dkim=pass header.d=example.com; dmarc=permerror header.from=example.com
```

The DMARC standard defines it as "a permanent error occurred during DMARC
evaluation, such as encountering a syntactically incorrect DMARC record."
Unlike `temperror`, retrying won't help.

## About "554 5.7.5 permanent error evaluating DMARC policy"

Some bounces quote this text. None of the large mailbox providers documents
it: Gmail reports DMARC failures as [550 5.7.26](/guides/550-5-7-26),
Microsoft as [550 5.7.509](/guides/550-5-7-509), and the standard meaning
of 5.7.5 is "cryptographic failure". Treat it as a permerror from a smaller
or custom mail system and work through the causes below.

## The causes

### SPF permerror

Most permerrors are really SPF's. SPF returns `permerror` when:

- **The record needs more than 10 DNS lookups.** Every `include`, `a`, `mx`,
  `ptr`, `exists` and `redirect` counts, including the ones inside other
  services' includes. See [SPF "too many DNS lookups"](/guides/spf-too-many-dns-lookups).
- **The domain has two SPF records.** Two TXT records starting with
  `v=spf1` is an error, not a merge. Combine them into one.
- **The record has a syntax error**, such as a typo in a mechanism.

An SPF permerror doesn't always mean DMARC fails: DMARC still passes if
DKIM passes for your domain. But it removes your backup, and some receivers
treat it as a failure on its own.

### DMARC record errors

Check the TXT record at `_dmarc.example.com`:

- **`v=DMARC1` must come first, and `p=` right after it.** A record
  without them is invalid.
- **There must be exactly one record.** With two, receivers stop and apply
  no DMARC policy at all. Microsoft reports this as `dmarc=permerror`.
- **Other tags with bad values** (a `pct` over 100, a `rua` without
  `mailto:`) should be ignored by receivers, but not every receiver is
  lenient.

A correct record looks like this:

```
_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
```

## How to fix it

1. **Look up your records.** Run `dig +short TXT example.com` and
   `dig +short TXT _dmarc.example.com`. Count the `v=spf1` and `v=DMARC1`
   records: there should be one of each.
2. **Count SPF lookups.** If you're over 10, remove services you no longer
   use, and replace includes of a single fixed IP with `ip4:`.
3. **Fix the DMARC syntax**, starting from the record above.
4. **Send a test** to Gmail and Outlook.com and check that the headers now
   show `pass` for SPF, DKIM and DMARC.

DNS changes take up to the record's TTL to reach every receiver.

## Check your domain

The [SPF lookup counter](/tools/spf-lookup-counter) counts lookups through
every include, and the [DMARC checker](/tools/dmarc-checker) checks your
DMARC record. The [free scan](/#scan) runs both.

## Sources

- [RFC 9989: DMARC](https://www.rfc-editor.org/rfc/rfc9989)
- [RFC 7489: DMARC (6.3 record syntax, 6.6.3 policy discovery, 11.2 permerror), obsoleted by RFC 9989](https://www.rfc-editor.org/rfc/rfc7489)
- [RFC 7208: SPF (4.5 multiple records, 4.6.4 lookup limits)](https://www.rfc-editor.org/rfc/rfc7208)
- [Microsoft: Troubleshoot email authentication](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-troubleshoot)
- [IANA: SMTP enhanced status codes](https://www.iana.org/assignments/smtp-enhanced-status-codes/smtp-enhanced-status-codes.txt)

---
Source: https://nameward.app/guides/dmarc-permerror (updated 2026-10-31)