The domain `madduck.net` has a simple SPF policy:
"v=spf1 ip4:188.174.253.166/32 ip6:2001:a60:902f::bcae:fda6/128 -all"
However, both `policyd-spf` as well as `spfquery` fail to report a
negative result when email is being delivered from another IP. The
following shows a debug run of `spfquery`, and it yields exactly the
same result as if `policyd-spf` saw a message with those cornerstone
data.
```
% spfquery.libspf2 -ip 130.60.75.242 -sender madduck@madduck.net -rcpt-to martin@tahi.ventures -helo diamond.madduck.net -debug
spf_compile.c:523 Debug: Parsing macro starting at Please%_see%_http://www.openspf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}
spf_compile.c:1210 Debug: Compiling record v=spf1
spf_dns.c:54 Debug: DNS[cache] lookup: madduck.net TXT (16)
spf_dns.c:54 Debug: DNS[resolv] lookup: madduck.net TXT (16)
spf_dns.c:66 Debug: DNS[resolv] found record
spf_dns.c:69 Debug: DOMAIN: madduck.net TYPE: TXT (16)
spf_dns.c:76 Debug: TTL: 0 RR found: 1 herrno: 0 source: resolv
spf_dns.c:94 Debug: - TXT: v=spf1 ip4:188.174.253.166/32 -all
spf_dns.c:66 Debug: DNS[cache] found record
spf_dns.c:69 Debug: DOMAIN: madduck.net TYPE: TXT (16)
spf_dns.c:76 Debug: TTL: 0 RR found: 1 herrno: 0 source: resolv
spf_dns.c:94 Debug: - TXT: v=spf1 ip4:188.174.253.166/32 -all
spf_server.c:402 Debug: get_record(madduck.net): NETDB_SUCCESS
spf_server.c:443 Debug: found SPF record: v=spf1 ip4:188.174.253.166/32 -all
spf_compile.c:1210 Debug: Compiling record v=spf1 ip4:188.174.253.166/32 -all
spf_compile.c:1314 Debug: Name starts at ip4:188.174.253.166/32 -all
spf_compile.c:1408 Debug: Adding mechanism type 5
spf_compile.c:847 Debug: SPF_c_mech_add: type=5, value=:188.174.253.166/32 -all
spf_compile.c:1314 Debug: Name starts at all
spf_compile.c:1408 Debug: Adding mechanism type 8
spf_compile.c:847 Debug: SPF_c_mech_add: type=8, value=
spf_interpret.c:491 Debug: ip_match: 130.60.75.242 == 188.174.253.166 (/32 255.255.255.255): 0
--vv--
Context: Main query
Response result: fail
Response reason: mechanism
Response err: No errors
StartError
EndError
--^^--
spf_compile.c:1210 Debug: Compiling record v=spf1 mx:@tahi.ventures
spf_compile.c:1314 Debug: Name starts at mx:@tahi.ventures
spf_compile.c:1408 Debug: Adding mechanism type 2
spf_compile.c:847 Debug: SPF_c_mech_add: type=2, value=:@tahi.ventures
spf_compile.c:689 Debug: Parsing domainspec starting at @tahi.ventures, cidr is optional
spf_compile.c:523 Debug: Parsing macro starting at @tahi.ventures
spf_dns.c:54 Debug: DNS[cache] lookup: @tahi.ventures MX (15)
spf_dns.c:54 Debug: DNS[resolv] lookup: @tahi.ventures MX (15)
spf_dns_resolv.c:311 Debug: query failed: err = -1 Unknown host (1): @tahi.ventures
spf_dns.c:66 Debug: DNS[resolv] found record
spf_dns.c:69 Debug: DOMAIN: @tahi.ventures TYPE: MX (15)
spf_dns.c:76 Debug: TTL: 0 RR found: 0 herrno: 1 source: resolv
spf_dns.c:66 Debug: DNS[cache] found record
spf_dns.c:69 Debug: DOMAIN: @tahi.ventures TYPE: MX (15)
spf_dns.c:76 Debug: TTL: 0 RR found: 0 herrno: 1 source: resolv
spf_interpret.c:824 Debug: found 0 MX records for @tahi.ventures (herrno: 1)
--vv--
Context: 2mx query
Response result: neutral
Response reason: default
Response err: No errors
StartError
EndError
--^^--
failneutral
Please see http://www.openspf.org/Why?id=madduck%40madduck.net&ip=130.60.75.242&receiver=spfquery : Reason: default
spfquery: 130.60.75.242 is neither permitted nor denied by domain of madduck.net
Received-SPF: neutral (spfquery: 130.60.75.242 is neither permitted nor denied by domain of madduck.net) client-ip=130.60.75.242; envelope-from=madduck@madduck.net; helo=diamond.madduck.net;
```