Audit a domain's SPF record. Catches spoof-friendly +all, missing terminators, and the RFC 10-lookup ceiling.