spf record audit derived

{
  "input": {
    "body": {
      "domain": "example.test",
      "records": [
        "v=spf1 include:_spf.vendor-a.test include:_spf.vendor-b.test include:_spf.vendor-c.test include:spf.vendor-d.test include:mail.vendor-e.test a mx ptr exists:%{i}._auth.example.test include:_spf.vendor-f.test include:_spf.vendor-g.test ~all include:late.vendor.test",
        "v=spf1 include:_spf.legacy.test ~all",
        "google-site-verification=abc123"
      ],
      "assume_lookups_per_include": 1
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "terms": [
        {
          "term": "include:_spf.vendor-a.test",
          "lookups": 1,
          "mechanism": "include",
          "qualifier": "+"
        },
        {
          "term": "include:_spf.vendor-b.test",
          "lookups": 1,
          "mechanism": "include",
          "qualifier": "+"
        },
        {
          "term": "include:_spf.vendor-c.test",
          "lookups": 1,
          "mechanism": "include",
          "qualifier": "+"
        }
      ],
      "valid": false,
      "domain": "example.test",
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "record": "v=spf1 include:_spf.vendor-a.test include:_spf.vendor-b.test include:_spf.vendor-c.test include:spf.vendor-d.test include:mail.vendor-e.test a mx ptr exists:%{i}._auth.example.test include:_spf.vendor...",
      "complete": false,
      "findings": [
        {
          "code": "SEVERAL_SPF_RECORDS",
          "detail": "2 records begin with v=spf1. More than one is a permanent error, and most receivers then treat the domain as having no SPF at all. Adding a vendor means merging into the one record, not adding another..."
        },
        {
          "code": "RECORD_LONGER_THAN_ONE_STRING",
          "detail": "The record is 264 characters. A single DNS character string holds 255, so this must be published as several strings inside one record, which is not the same as several records."
        },
        {
          "code": "PTR_MECHANISM_USED",
          "detail": "The record uses ptr, which the specification says should not be published: it is slow, it costs a lookup, and some receivers ignore it entirely."
        }
      ],
      "request_id": "example-request",
      "service_id": "spf_record_audit",
      "assumptions": [
        "Nothing resolves DNS. The records are supplied, which keeps the egress surface at zero and means an arbitrary domain can be audited without this service holding an allowlist for it.",
        "An include is counted at the stated cost per include, and the included record is not read, so the lookup count here is a floor rather than the true total. That is said rather than presented as exact.",
        "An unrecognised term is reported rather than skipped, because an unrecognised mechanism is itself a permanent error and skipping it would report a broken record as sound."
      ],
      "limitations": [
        "The records supplied. Whether they are actually published, whether an include resolves, and what any particular receiver does are outside this.",
        "valid is true only when the record parsed, stayed inside the lookup limit, and nothing was left unexamined."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "lookup_limit": 10,
      "not_examined": [
        "RECORD_NOT_SPF: A record was supplied that does not begin with v=spf1 and was not evaluated: google-site-verification=abc123",
        "INCLUDE_TREE_NOT_EXPANDED: Each include and redirect was counted as 1 lookup(s) because the included records were not supplied. The real total is at least this and usually more, so the count here is a..."
      ],
      "record_count": 3,
      "finding_count": 5,
      "service_version": "1.0.0",
      "findings_by_code": {
        "TERM_AFTER_ALL": 1,
        "PTR_MECHANISM_USED": 1,
        "SEVERAL_SPF_RECORDS": 1,
        "LOOKUP_LIMIT_EXCEEDED": 1,
        "RECORD_LONGER_THAN_ONE_STRING": 1
      },
      "minimum_dns_lookups": 12,
      "lookups_assumed_per_include": 1
    }
  }
}