How to check whether an IP is in your SPF
The question "may this IP address post as my domain?" you do not answer from the SPF text itself — that text is a chain. An include can refer to another include, a redirect to another text, and only at the end of that chain stands whether the address passes. And that chain has a limit: RFC 7208 allows ten queries, no more.
The SPF recomputation follows the entire chain through our resolver and gives exactly the answer a receiver would give: pass, fail, softfail, neutral — or one of the error forms permerror and temperror, named as RFC 7208 defines them. A chain that reaches the limit ends there as a limit, not as a guess.
This article shows why "that SMTP server passes my SPF" often means something other than you thought, and how to keep the three layers (mail-from, HELO, mechanisms) apart.
The text is a chain, not a list
`v=spf1 ip4:... include:_spf.service.com include:servers.example.net -all` — what stands directly in your TXT is one part of the story. Every include asks a new TXT at another domain, and each of those can include again. What a receiver evaluates is the entire chain, and what you write is only the top sheet.
The lookup limit is not a suggestion
Ten queries — mechanisms whose mechanics require DNS queries (include, redirect, a, mx, ptr) — and then the room is up. An SPF that goes past it does not fail with "no" but with permerror: the receiver may then ignore the entire mechanism. The recomputation shows the chain with its counter, so you see where the tenth query falls.
Mail-from and HELO are separate checks
An SMTP conversation asks twice: first for the HELO/EHLO identity of the connecting server, then for the mail-from address. Both can be covered by their own SPF texts, and a server that passes one check and not the other is a classic half-set. Give the recomputation both domains and both addresses and compare the outcomes.
After the check: who actually stands on your list?
If the address passes, the next question is who all passes: parties you once added and forgot. The DNS lookup shows your SPF text directly from the TXT layer, and SPF, DKIM and DMARC explained places the text back in the larger whole — because an SPF that allows everything is technically correct and practically an empty wall.