Our customers are complaining about the spam issue. There are a number of spam emails which are not tagged as spam emails. These spam emails were sent from forged seneder address, which means our SPF record does not work. We have set up the SPF record in our DNS record and we have used some SPF checker tools to check the validity of our SPF record, but no problem was reported in the check results. I have checked an email of our customer and find that there is an item "X-Bordeaux-SPF: PermError" in the email header, but no more detail was presented in the email header. I have read many resources about permerror in SPF, but I still did not find the answer which can explain the reason in this case. Now I have no idea what's the problem with our SPF record. What could be the cause for this kind of permerror?

The domain is "made-in-china.com". The SPF record is "v=spf1 include:spf.made-in-china.com -all". Here are email headers:

Received: from iredmail.wattan.tv([]) by smail59.cn4e.com( with ESMTP id FE2E06430007.224.1547615038.691636;
    Wed, 16 Jan 2019 13:04:04 +0800 (CST)

X-BQId: FE2E06430007.224.1547615038.691636.1

X-Bordeaux-Type: SMTP
X-35BMId: FE2E06430007.224.1547615038.691636.1

    Action: Relay[NEXT,10180,100:100:100],Relay[NEXT,100001,100:100:100],Relay[NEXT,208,100:100:100],Relay[NEXT,405,100:100:100],Relay[NEXT,10143,100:100:100],Relay[NEXT,10158,100:100:100],Relay[NEXT,10162,100:100:100],Relay[NEXT,10164,100:100:100],Relay[NEXT,10166,100:100:100],Relay[NEXT,10170,100:100:100],Relay[NEXT,10171,100:100:100],Relay[NEXT,10191,100:100:100],Relay[NEXT,10214,100:100:100],Relay[NEXT,10183,100:100:100],Relay[NEXT,10184,100:100:100],Relay[NEXT,10185,100:100:100],Relay[NEXT,10186,100:100:100],Relay[NEXT,10146,100:100:100],Relay[SPAM,1009,100:100:100],Relay[NEXT,10015,100:100:100],Relay[NEXT,10181,100:100:100],Relay[NEXT,100002,100:100:100]





X-Bordeaux-SPF: PermError
  • Make sure ALL the DNS TXT records have propagated. You have many includes/entries from what I saw. From error you show, a SPF is not formatted correctly somewhere in the included records. And consequently it appears MDA failed to classify it as spam. I tried to view most of your SPF records and they looked okay to me.
    – B. Shea
    Jan 21 '19 at 0:11
  • "If a domain has no SPF record at all, the result is "None". If a domain has a temporary error during DNS processing, you get the result "TempError" (called "error" in earlier drafts). If some kind of syntax or evaluation error occurs (eg. the domain specifies an unrecognized mechanism) the result is "PermError" (formerly "unknown")." openspf.org/SPF_Record_Syntax
    – B. Shea
    Jan 21 '19 at 0:21
  • Also make sure you have no 'loops' in your SPF includes/DNS lookups.
    – B. Shea
    Jan 21 '19 at 0:26

SPF records do not directly prevent you from receiving SPAM. SPF records simply define a list of authorized servers that are allowed to send email on your domains behalf. This is to prevent others from spoofing emails with your domain name. When an email is sent, the remote server's spam software will look at the sender's domain spf records and make sure that the remote servers ip address is in the list of authorized servers. If it's not, the spam software will reject the email. This will also apply to email that your server receives from an outside email server with your domain. Therefore it will prevent spam that you receive with spoofed address with your domain.

As far as the permerror, you should look at the from address domain's SPF records and see if they are correct. Feel free to post the SFF record if you want me to look at them.

  • Accually, the sender ip address is not in the ip address list of our SPF record.
    – yifan
    Jan 20 '19 at 1:53
  • And I have already added the domain information, you can use dig command to check SPF record.
    – yifan
    Jan 20 '19 at 2:01
  • 1
    @yifan Your SPF record is correct. This email did not match your SPF record, which is why it is tagged permerror. But the recipient did not reject the message. You cannot force the recipient of spam to reject it. You can only tell them that it is spam. You have done everything correctly. The problem is with the recipient's server. Jan 20 '19 at 2:03
  • 1
    @MichaelHampton, you can see the description about permerror in openspf.org/SPF_Record_Syntax. If this email did not match our SPF record, it should not be tagged as permerror.
    – yifan
    Jan 20 '19 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.