HighAuthentication · usually high
SPF record contains a syntax error
Part of the record is not valid SPF, so receivers may reject the whole record.
Check your own domain
What causes this
SPF has a strict grammar: a version tag, then a sequence of mechanisms and modifiers separated by single spaces. A malformed term — a typo in a mechanism name, a stray character, a missing colon — makes the record invalid. Some receivers stop at the bad term, others return permerror for the entire record, so the observable behaviour is inconsistent and hard to debug.
What it breaks
SPF results become unreliable and differ between receivers. Mechanisms after the error may be ignored entirely.
How to fix it
Correct the invalid term so the record parses cleanly.
- Review the flagged term against the SPF grammar.
- Check for the usual causes: a space inside an include value, a missing colon after include, a smart quote pasted from a document, or two mechanisms run together.
- Republish the corrected record and re-check.
Specification: RFC 7208 — Sender Policy Framework
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.