spf include budget audit derived

{
  "input": {
    "body": {
      "domain": "example.test",
      "records": [
        {
          "domain": "example.test",
          "record": "v=spf1 include:_spf.vendor-a.test include:_spf.vendor-b.test include:_spf.shared.test ~all"
        },
        {
          "domain": "_spf.vendor-a.test",
          "record": "v=spf1 a mx include:_spf.shared.test include:_spf.regional.test ip4:203.0.113.0/24 ~all"
        },
        {
          "domain": "_spf.vendor-b.test",
          "record": "v=spf1 a:mail.vendor-b.test mx include:_spf.vendor-a.test ip4:198.51.100.0/24 ~all"
        },
        {
          "domain": "_spf.shared.test",
          "record": "v=spf1 a mx exists:%{i}._auth.shared.test ip4:192.0.2.0/24 ~all"
        },
        {
          "domain": "_spf.regional.test",
          "record": "v=spf1 include:_spf.unsupplied.test a ~all"
        }
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "domain": "example.test",
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "domains": [
        {
          "terms": 6,
          "domain": "_spf.vendor-a.test",
          "record": "v=spf1 a mx include:_spf.shared.test include:_spf.regional.test ip4:203.0.113.0/24 ~all",
          "own_lookups": 4
        },
        {
          "terms": 6,
          "domain": "_spf.vendor-a.test",
          "record": "v=spf1 a mx include:_spf.shared.test include:_spf.regional.test ip4:203.0.113.0/24 ~all",
          "own_lookups": 4
        },
        {
          "terms": 5,
          "domain": "_spf.shared.test",
          "record": "v=spf1 a mx exists:%{i}._auth.shared.test ip4:192.0.2.0/24 ~all",
          "own_lookups": 3
        }
      ],
      "complete": false,
      "findings": [
        {
          "code": "LOOKUP_LIMIT_EXCEEDED",
          "detail": "The whole evaluation needs 27 DNS-resolving mechanisms against a limit of 10. Beyond the limit the result is a permanent error, which most receivers treat as the domain having no SPF, so every message..."
        }
      ],
      "headroom": -17,
      "request_id": "example-request",
      "service_id": "spf_include_budget_audit",
      "assumptions": [
        "The budget is shared across the whole evaluation rather than per record, as the specification defines it. That is why a record with three includes can cost fourteen lookups and no single record looks ...",
        "A domain included from two places spends its lookups on each path, because there is no cache across mechanisms within one evaluation. That is noted, since it is the usual reason a budget is spent fast...",
        "An include whose record was not supplied contributes nothing, so the total is a floor rather than the true count, and every such domain is listed."
      ],
      "limitations": [
        "The tree supplied. Nothing resolves DNS, so a vendor record that has grown since the tree was captured is not reflected here.",
        "within_budget is true only when the whole tree was supplied and the total stayed clear of the limit."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "lookup_limit": 10,
      "not_examined": [
        "DOMAIN_INCLUDED_TWICE: _spf.vendor-a.test is included from more than one place. Its lookups are spent on each path, which is what makes a shared vendor include expensive.",
        "DOMAIN_INCLUDED_TWICE: _spf.shared.test is included from more than one place. Its lookups are spent on each path, which is what makes a shared vendor include expensive.",
        "DOMAIN_INCLUDED_TWICE: _spf.regional.test is included from more than one place. Its lookups are spent on each path, which is what makes a shared vendor include expensive."
      ],
      "finding_count": 1,
      "within_budget": false,
      "service_version": "1.0.0",
      "findings_by_code": {
        "LOOKUP_LIMIT_EXCEEDED": 1
      },
      "total_dns_lookups": 27,
      "unresolved_includes": [
        "_spf.unsupplied.test"
      ],
      "supplied_record_count": 5,
      "evaluated_domain_count": 9
    }
  }
}