SPF record validation now detects misalignments in CIDR syntax

SPF record validation now detects when an ip4 or ip6 mechanism uses a CIDR prefix length but the IP address is not the network address for that prefix.

For example, ip4:192.0.2.123/28 is flagged because .123 is a host address within the /28 block but not the network address, which would be .112. This usually indicates a mistake: the author likely meant either the full network (ip4:192.0.2.112/28) or just the single host (ip4:192.0.2.123).

The same applies to IPv6: ip6:2001:db8:abcd:1234::5/48 would be flagged because the network address for /48 is 2001:db8:abcd::.

Although the SPF specification doesn’t strictly forbid this misaligned syntax, but picky receivers may still flag this as an error. For this reason, this validation issue is now reported as a warning.

The UI also shows proposed corrections for the misaligned mechanism, depending on whether the intended behavior is to authorize the full network or just the single host.