SPF_IP_UNDETERMINED

warning

Whether this domain's SPF record authorises the sending address depends on something that is not in DNS, so it cannot be decided from the records alone.

Working today, and one change away from not working.

How we know

spf.test
The ten-lookup and two-void limits of RFC 7208 4.6.4 are spent across a whole include: tree, so neither is visible in any single record. Each name here is sized to land one term either side of a boundary, which is the only way an off-by-one in the accounting shows up as a failure rather than as a plausible number. The address-matching names carry both an A and a AAAA so that `a` can be shown following the client's family, and a /24 so that a matcher ignoring the prefix is caught. The macro names resolve only for one specific sender, which is what makes an expansion bug visible rather than merely different.