This approach raises several areas of concern, according to Levine.
First, there has been no large-scale experience in using SPF to reject email. We do know, however, that a non-trivial number of early SPF adopters have found it difficult to correctly describe even relatively simple networks in SPF syntax. Once you factor in more complex arrangements, such as multi-homed inbound/outbound systems, outsourced email and mailing list hosting environments, remote offices with their own email infrastructures, etc.,
we still don't know the extent to which SPF will break email.
Levine experimented by creating a complex series of nested SPF records that are not all that different from a conceivable configuration for a moderately large and widely distributed email infrastructure. His results? Upwards of one hour to look up the SPF records for just a single email. If a legitimate set up could do this, an evil-doer could cause mail servers to launch Denial-of-Service attacks on themselves simply by seeding bogus data in nested records and sending your mail server on a wild goose chase that would bring down your inbound mail.
