SPF authentication failed with a permanent error

[cbrake]

I recently ran into a problem where someone using Google mail tried to send me a message, and got:

I looked in the Maddy logs, and saw:

Mar 30 13:13:50 mail5 maddy[42586]: smtp: incoming message        {"msg_id":"","sender":"[email protected]","src_host":"mail-io1-xd36.google.com","src_ip":"[2607:f8b0:4864:20::d36]:40699"}
Mar 30 13:13:50 mail5 maddy[42586]: smtp: RCPT ok        {"msg_id":"b2404cec","rcpt":"[email protected]"}
Mar 30 13:13:50 mail5 maddy[42586]: smtp: DATA error        {"check":"check.spf","msg_id":"b2404cec","reason":"lookup limit reached","smtp_code":550,"smtp_enchcode":"5.7.23","smtp_msg":"SPF authentication failed with a permanent error"}

The sender tried twice and got the same error both times.

Has anyone run into this or know what is going on here? SPF records are a simple DNS record.

The sender uses google mail for their biz address.

I then tried sending from my gmail account, and that worked fine.

[cbrake]

This is likely what is generating the "lookup limit reached" error.

https://blitiri.com.ar/git/r/spf/b/master/t/f=spf.go.html#line-341

Does this mean Google's SPF DNS setup is not working correctly?

From https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4

When evaluating the "mx" mechanism, the number of "MX" resource records queried is included in the overall limit of 10 mechanisms/modifiers that cause DNS lookups as described above. In addition to that limit, the evaluation of each "MX" record MUST NOT result in querying more than 10 address records -- either "A" or "AAAA" resource records. If this limit is exceeded, the "mx" mechanism MUST produce a "permerror" result.

[cbrake]

Seems there are several options:

1. Google SPF setup is not compliant with ietf
2. the SPF package is not counting DNS lookups correctly

Since I likely can't change Google, it seems options are:

1. change maddy config to not reject these messages.
2. modify maddy to allow a config option to set a higher number of DNS lookups before fail.

Looks like there has been about 41 of these rejections in the last month, so not a significant number in the spam volume I receive.

[foxcpp]

@albertito have you ever encountered that with gmail?

[albertito]

have you ever encountered that with gmail?

What's the domain? And the sending IP? That shouldn't happen with Gmail. What could be happening is that the domain's SPF is including Google's spf incorrectly and causing lookups to reach the limits. For example if they have a lot of their own checks before including Gmail's. What happens if you check using one of the detailed validators, such as: https://vamsoft.com/support/tools/spf-policy-tester ?

[cbrake]

@albertito you are dead on -- I forgot this was a custom domain, SPF is under control of the domain owner, not google -- thanks for pointing that out.

This is the domain: https://mxtoolbox.com/SuperTool.aspx?action=spf%3afarmation.us&run=toolpage