dmarc=permerror

dmarc=permerror means the receiver tried to apply DMARC and hit an error that retrying won't fix. Nearly always that is a DMARC record it couldn't make sense of. No verdict was reached, so the domain's policy wasn't applied.

What the RFC says

RFC 9989 §9.2 defines permerror as an unrecoverable error during evaluation, and gives an improperly formatted DMARC record as the example, as RFC 7489 §11.2 did before it. The new standard is fairly forgiving about bad records, though, which makes permerror the receiver's judgment call:

• Syntax errors in individual tags are to be dropped in favor of defaults (§4.8).
• A record with a missing p= is treated as p=none (§4.7). With an invalid p=, it is treated as p=none only if it has a valid rua=. Otherwise DMARC isn't applied at all (§4.10.1).
• If two DMARC records turn up at the same name, both are thrown away (§4.10). The result then looks like no record.
• If a needed DNS query fails permanently, the message can neither pass nor fail (§5.3.6).

So one receiver may write permerror for a record that another quietly treats as p=none or as missing. That is worth knowing when your reports disagree.

Authentication-Results: mx.example.org;
       spf=pass smtp.mailfrom=example.com;
       dkim=pass header.d=example.com;
       dmarc=permerror (bad DMARC record) header.from=example.com

Mistakes that cause it

1. The record doesn't start with v=DMARC1. It must be the very first tag, spelled exactly that way. Records with v=DMARC1 placed later, or v=dmarc1; with stray characters, get discarded or flagged.
2. Misspelled values: p=quarentine, p=rejected, adkim=relaxed instead of r.
3. Two TXT records at _dmarc, typically left behind when a vendor's setup wizard added its own.
4. Smart quotes or a line break pasted from a document, so the DNS panel stores characters the parser rejects.
5. The wrong place: a DMARC string put at the domain apex or inside the SPF record instead of at _dmarc.domain.

If you received this message

It is the sender's configuration fault, not a sign of forgery. But the domain's protection is off until they fix it. In the snippet, SPF and DKIM both passed for the From domain, so the sender is authenticated anyway. Paste the headers into the analyser, which checks alignment itself.

If you own the domain

Pull every TXT record at _dmarc.yourdomain and keep exactly one, written in plain ASCII, for example v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain. Use only tags from the current list in §4.7. Note that pct= is no longer part of the standard. Then send yourself a test and confirm the header shows dmarc=pass.