DMARC reports or headers show SPF result “temperror” (sometimes surfaced as a 4xx “temporary error in SPF processing”), and some mail is deferred rather than rejected.
Unlike permerror, temperror is transient. RFC 7208 §2.6.6 defines it as a temporary DNS failure — a timeout, SERVFAIL, or an unreachable nameserver — during SPF evaluation, so the receiver can't finish the check and typically defers the message (4xx) to retry later. It is not a broken record: a permerror is a structural fault that fails every time, while a temperror clears on its own once DNS answers. Persistent temperror usually points at a flaky authoritative nameserver, a DNSSEC misconfiguration, or an include: whose host intermittently times out. Source: RFC 7208 §2.6.6 · verified 2026-07-15
include: host's DNS resolution; a slow or timing-out nested include is the usual cause.DNS changes propagate within minutes to 48 hours. Mailbox providers pick up the new records on their next check — most senders see bounces stop within a day of correct configuration.
Formal enforcement targets bulk senders, but partial authentication already costs you inbox placement at every volume — and spoofing protection matters regardless of how much you send.
Hosting support can add DNS records for you, but they don't know which services send as your domain. You (or a monitoring tool reading your DMARC reports) have to provide that list — that's the actual hard part.