SPF Practitioner — assessment

Sample question

A record reads v=spf1 ip4:192.0.2.0/24 a mx include:_spf.vendor.example -all. The domain has two MX hosts and the vendor record contains only literal ranges. How many DNS lookups does an evaluation cost?

• Five — a is 1, mx is 1 for the set plus 1 per host, and the include is 1.The ip4 term is free, a costs 1, mx costs 1 for the MX RRset plus 1 for each of the two hosts, and the include costs 1 with nothing beneath it. Counting mx as a single lookup is the usual error and would have given 3.
• Three — one each for a, mx and include.The common miscount. mx must resolve every host the MX set names, and each of those is a separate query against the budget.
• Four — the ip4 term also costs one.Literal address ranges are matched without querying anything. They are the only genuinely free terms.
• Six — the initial fetch of the record counts too.RFC 7208 §4.6.4 excludes the initial record fetch, which is the most common off-by-one in a manual audit.

Every option carries an explanation, including the wrong ones.