{
  "id": 5042314,
  "title": "I scanned 500 domains to test my SPF checker. It found four bugs in the checker.",
  "url": "https://urgent.news/2026/09/02/i-scanned-500-domains-to-test-my-spf-checker-it-found-four-bugs-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-02T07:42:31.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/linxia_echo_d827208a7fe99/i-scanned-500-domains-to-test-my-spf-checker-it-found-four-bugs-in-the-checker-1jmb"
  },
  "original_language": "en",
  "account": "In a test of their SPF checker, one researcher scanned 500 domains and found that their own checker contained four bugs. The SPF protocol allows for ten DNS lookups during evaluation, but if the chain requires an eleventh, it returns permerror and disregards the entire record. The researcher discovered that their checker miscounted lookups, leading to false positives and false negatives.\n\nFirstly, the checker incorrectly counted include mechanisms and their associated mechanisms as single lookups when they should be counted as six. Secondly, the checker resolved bare \"a\" and \"mx\" records against the wrong domain, querying unrelated records and misattributing void lookups. Thirdly, the checker treated partial expansions as reliable, even when they undercounted the total number of lookups, causing a significant number of false negatives.\n\nLastly, the researcher's checker improperly handled truncated DNS responses. When the response was truncated and could not fit in a 512-byte UDP packet, the checker falsely concluded that the domain had no SPF record. This mistake could result in an inaccurate assessment of a domain's SPF compliance, potentially leading to miscommunication or misplaced trust. The researcher fixed this issue by ensuring their resolver performed EDNS0 and TCP fallbacks.",
  "summary": "SPF has a limit almost nobody hits on purpose and plenty of people hit by accident: a receiver is allowed to make ten DNS lookups while evaluating your record, and if the chain needs an eleventh it returns permerror and throws your entire SPF away. Not the eleventh mechanism — the whole record. Your carefully maintained list of authorised senders stops meaning anything, and nothing anywhere tells…",
  "key_points": [
    "Researcher scanned 500 domains with SPF checker, discovered four bugs",
    "Checker miscounted DNS lookups, causing false positives/negatives",
    "Improper handling of truncated DNS responses led to inaccurate SPF assessment"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}