Troubleshooting Tip: How to troubleshoot the ‘SPF=PERM-ERROR the SPF record is invalid’ error

1. The FortiMail detected the below error in the email cross-search log:

• Classifier: SPF check.
• SPF=PERM-ERROR: (envelope from: userA@example.com) the SPF record for example.com is invalid.

2. Check current DNS settings in FortiMail, and navigate under System -> Network -> DNS tab.
3. Query the TXT record from the configured DNS server:

exec nslookup name example.com type txt

Verify if the result is the same as the TXT record configured in the domain DNS.

Example output as below :

4. If the output is not the same as configured in the DNS, try to change to a private DNS server or any other DNS server to verify the result.

To specify a particular server, add the server option to the nslookup command.

exec nslookup name example.com type txt server [x.x.x.x]

Verify the correct format for the SPF or if is there any typo error in the above output.

5. If all output is correct, perform another email test to verify the result.