Dear Maintainer,

Exim, which uses SPF checks in my setup, gave me a failed SPF check on an email. I looked into the issue and it seems to me that it should actually pass.

The sender domain is wolterskluwer.com, that has 59 TXT records in its DNS.
The SPF record is quite convoluted, and I was expecting some sort of failure in recursively handling the included records, since the IP that failed was one of salesforce that is the last inclusion and also uses a complex construct.

But it seems it's something far more easy, since the command

spfquery -debug=3 -ip=13.48.121.234 -sender=wolterskluwer.com

that is the "manual" query for the email that failed SPF test, gives an output that states:

Response result: none
Response reason: (invalid reason)
Response err: Could not find a valid SPF record

While in the (long) series of TXT records that are resolved, there is one SPF record that seems valid to me.

v=spf1 include:spf.wolterskluwer.com include:spf2.wolterskluwer.com ~all

So it seems that with such a long list of TXT records, libspf fails to
find the spf record at all.

I have checked the whole inclusion chain manually (by using nslookup and
checking responses) and it should actually pass.

I have checked it using an online tool at
https://www.kitterman.com/spf/validate.html and it does indeed pass.

I have also reported the bug upstream at
https://github.com/shevek/libspf2/issues/55

Sorry for the misleading report, but it seems I got it wrong.

I suppose the syntax of my command:

spfquery -debug=3 -ip=13.48.121.234 -sender=wolterskluwer.com

is wrong, and the right syntax is the following:

spfquery  -ip=13.48.121.234 -sender=wolterskluwer.com  -debug


Using the right syntax leads to a softfail, which is wrong anyway, because a PASS should be the correct answer.