Unless I'm really wrong myself, I think the tool at
http://www.dnsstuff.com/pages/spf.htm is broken.
This is a real life example from an unsuspecting person so I have
to anonymize it slightly:
----cut here----
SPF lookup of sender account(_at_)xxxxx(_dot_)xxx from IP aaa.bbb.ccc.ddd:
SPF string used: v=spf1 ip4:206.40.48.0/24 ip4:64.78.15.0/24 ip4:64.78.21.0/24
ip4:64.78.59.0/24 ip4:64.78.61.0/24.
Processing SPF string: v=spf1 include:spf.intermedia.net ~all.
Testing 'include:spf.intermedia.net' on IP=aaa.bbb.ccc.ddd, target domain
spf.intermedia.net, CIDR 32, default=PASS.
include: including SPF at spf.intermedia.net.
Processing SPF string: v=spf1 ip4:206.40.48.0/24 ip4:64.78.15.0/24
ip4:64.78.21.0/24 ip4:64.78.59.0/24 ip4:64.78.61.0/24.
Testing 'ip4:206.40.48.0/24' on IP=aaa.bbb.ccc.ddd, target domain
206.40.48.0/24, CIDR 24, default=PASS. No match.
Testing 'ip4:64.78.15.0/24' on IP=aaa.bbb.ccc.ddd, target domain 64.78.15.0/24,
CIDR 24, default=PASS. No match.
Testing 'ip4:64.78.21.0/24' on IP=aaa.bbb.ccc.ddd, target domain 64.78.21.0/24,
CIDR 24, default=PASS. No match.
Testing 'ip4:64.78.59.0/24' on IP=aaa.bbb.ccc.ddd, target domain 64.78.59.0/24,
CIDR 24, default=PASS. No match.
Testing 'ip4:64.78.61.0/24' on IP=aaa.bbb.ccc.ddd, target domain 64.78.61.0/24,
CIDR 24, default=PASS. No match.
Testing 'all' on IP=aaa.bbb.ccc.ddd, target domain cygen.com, CIDR 32,
default=SOFTFAIL.
Result: NEUTRAL
----cut here----
I was doing the stuff by hand and concluded that the result should
have been SOFTFAIL, not because the included record ends in "~all"
but because the original record does so as well.
If this is not correct, please enlighten me. If is _is_ correct, can
someone contact Scott Perry? He doesn't want to mail with people that
reject messages from his DSL connection so please be careful and don't
step on his toes :)
TIA
Alex