CaptainDNS · March 4, 2026
SPF PermError: the complete guide to understanding, diagnosing and fixing this error
Diagnose and fix SPF PermError: the 6 causes, the impact on DMARC and the methods to repair your SPF record.
New
Free MTA-STS policy hosting
Protect your emails against man-in-the-middle attacks. CaptainDNS hosts your MTA-STS policy for free, no server required.
DNS & deliverability platform
Everything you need to verify your DNS zones and email authentication
Resolve, audit and fix DNS, SPF, DKIM, DMARC and BIMI records from a single dashboard with easy-to-use diagnostics.
- Domains analysed
- 48K+
Aggregated data since 2025
- DNS queries processed
- 12M/mo
- SPF/DKIM/DMARC reports generated
- 260K+
- Active monitors
- 8K+
Alerts sent as soon as a difference or latency anomaly is detected
Core engines
Three modules at the heart of CaptainDNS to troubleshoot zones, secure authentication and keep campaigns out of spam folders.
Universal DNS lookup
Instant A, AAAA, MX, TXT and CNAME resolutions across 18 resolvers with latency and RCODE insights.
Start a lookupOnline DKIM checker
Instantly validate your DKIM signatures, verify the DNS public key and diagnose configuration errors blocking your emails.
Check a DKIMSPF/DKIM/DMARC analyzers
Hardened parsers, policy suggestions and lookup budgeting to prevent blocks and maximise alignment.
Explore analyzers
Email header analysis
Decode your email headers in an instant
Paste raw email headers and get a detailed report on authentication, delivery path and spam verdict.
- Automatic SPF, DKIM and DMARC validation with trust verdict
- Deliverability score and instant spam diagnosis
- Complete identification of sender identities and recipients
- Full delivery path and transit server analysis
Deliverability audit
Audit your domain before every campaign
Get a complete deliverability score and actionable recommendations to fix your SPF, DKIM, DMARC, BIMI and MX records.
- Comprehensive audit of all email authentication protocols
- Detailed compliance score with rating per protocol
- MX records verification and TLS configuration check
- BIMI validation with logo extraction and display
Latest articles
BlogCaptainDNS · March 3, 2026
SPF Flattening vs SPF Macros: Which Approach Should You Choose to Stay Within the 10 Lookup Limit?
Detailed comparison of SPF flattening and SPF macros: how they work, advantages, disadvantages, and a decision matrix to help you choose the right approach.
CaptainDNS · March 3, 2026
SPF "Too Many DNS Lookups": The Complete Guide to Fixing the 10 Lookup Limit
Diagnose and fix the SPF "too many DNS lookups" error: how lookups are counted, what causes the limit to be exceeded, and 5 methods to stay within the limit of 10.
About
Making deliverability transparent for the teams that run email
We build CaptainDNS to give marketing and SRE teams complete visibility into DNS configuration and deliverability signals. Every tool explains what must be fixed and why it matters.
Our distributed infrastructure mirrors the reality of your recipients. Know whether resolvers in Frankfurt, Sydney or Montreal see the same answer, and get alerted as soon as a divergence appears.
- Global resolvers monitored
- 18
- Uptime over 12 months
- 99.99%
- Support response time
- < 24 h
- Continents covered
- 4
FAQ
Frequently asked questions
Stay in control of DNS and deliverability with actionable explanations. Here are the answers to the most common requests.
Does the DNS lookup run from multiple regions?
Yes, each query runs across 18 resolvers on four continents so you see what your recipients experience.
Can I export my audit results?
Reports and histories download as CSV, JSON and PDF. Pro plans can also push exports to S3 or BigQuery.
How do monitoring alerts work?
Pick a domain and record type to watch: we automatically query 18 resolvers and notify you by email or webhook as soon as a difference or latency anomaly appears.
How do you handle oversized SPF records?
SPF Lab calculates lookup counts, highlights cascading includes and suggests safe flattening strategies.
Can I share a saved request?
Yes. Every stored request includes a shareable link with sensitive inputs redacted, and you can turn it into a monitor in one click.
Is there an API?
Absolutely. Every key capability is available through a REST API with token authentication and webhooks for alerts.
Is the platform a good fit for agencies?
Multi-brand organisations are supported with shared access, folders and per-client quotas.
Do you offer a free trial?
All tools can be launched for free. Paid plans unlock history, automated exports and priority support.
Launch your next audit in seconds
Try it for free, then upgrade to the plan that matches your volume when you're ready.