FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,242,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

SPF PermError: Void Lookup Limit Exceeded or Include Domain Not Found

The short answer (what's causing it)

RFC 7208 lets receivers return PermError when more than two lookups return no answer (NXDOMAIN or empty). This happens when an include: points at a vendor you no longer use, or a typo. (For the separate 10-lookup ceiling see our existing SPF 10-lookup guide.)

Step-by-step fix

  1. Scan free to list each include and whether it resolves.
  2. Remove includes for retired vendors; fix typos.
  3. Check a, mx and exists mechanisms resolve.
  4. Re-scan to confirm pass.

Record examples (replace example.co.uk with your domain)

# Before
example.co.uk. TXT "v=spf1 include:old-vendor.example include:spf.protection.outlook.com -all"
# After
example.co.uk. TXT "v=spf1 include:spf.protection.outlook.com -all"

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: SPF, DNS TXT.

Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

Is this the same as 'too many DNS lookups'?

No — that's the 10-lookup limit. Void lookups are a separate limit of 2.

Do all receivers enforce it?

Enforcement varies; fixing it removes the risk.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.