temperror is the result people escalate to the wrong team. It almost never means your record is wrong, and treating it as though it does produces changes that fix nothing.
What it means
A DNS query during evaluation failed in a way that might succeed later: a timeout, a SERVFAIL, an unreachable nameserver, a lost UDP response. The receiver cannot conclude anything, so it defers rather than rejecting — mail is typically queued and retried, not bounced.
| permerror | temperror | |
|---|---|---|
| Cause | The record as written. | The DNS infrastructure serving it. |
| Retry helps | No. Never. | Usually, yes. |
| Whose | Yours, always. | Yours, an included domain’s, or the receiver’s resolver. |
| Fix | Edit the record. | Find which nameserver is failing. |
Finding the failing name
The failure is in one of the queries the evaluation makes, so walk the same tree and watch for anything slow or intermittent rather than absent:
# every name in the tree, several times, watching for variance
for t in _spf.vendor-a.example _spf.vendor-b.example; do
for i in 1 2 3 4 5; do
printf '%-34s ' "$t"
dig +tries=1 +time=2 TXT "$t" | grep -E 'status:|Query time'
done
done- Consistently fine locally, failing in reports — likely the receiver’s resolver or a network path, and not actionable by you.
- Intermittent for one included domain — that vendor’s nameservers. Report it to them; you cannot fix it, and you can stop including them.
- Intermittent for your own domain — your nameservers. Check all of them individually; one failing secondary produces exactly this pattern while the domain looks fine from wherever you happen to be.
- Only under load — rate limiting or a resolver hitting a per-query cap. Records deep in nested includes make many queries.
Persistent temperror is a real outage
Occasional temperror in a large report set is background noise — the internet is lossy. Persistent temperror is your mail being deferred at every receiver that tries, and it reads as delivery delays rather than an authentication problem, so it is often escalated as "email is slow". If SPF temperror is climbing, check nameserver health before anything else.
Reducing your exposure
Every nested include is another set of nameservers that can fail on your behalf. A record with eight includes depends on the DNS availability of eight organisations, and any one of them having a bad afternoon shows up as your mail being deferred. That is a second, quieter argument for the delegation and removal work in module 4 — fewer dependencies, fewer people who can break you.