Example of how the Authentication-Results header complains about DNS reply/DNS failure:
Authentication-Results: xxxxxxxx; sender-id=softfail (DNS reply garbled) header.from=jcm@sics.se; spf=softfail (DNS failure) smtp.mfrom=jcm@sics.se
So, doing dig TXT against domain sics.se to see if there's something wrong, reveals this:
# dig TXT sics.se
; <<>> DiG 9.4.1-P1 <<>> TXT sics.se
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22446
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 4, ADDITIONAL: 5
;; QUESTION SECTION:
;sics.se. IN TXT
;; ANSWER SECTION:
sics.se. 84653 IN TXT "SE-164 29 KISTA, SWEDEN"
sics.se. 84653 IN TXT "Swedish Institute of Computer Science"
sics.se. 84653 IN TXT "PO Box 1263"
sics.se. 84653 IN TXT "Fax: +46 8 751 72 30"
sics.se. 84653 IN TXT "Tel: +46 8 633 15 00"
;; AUTHORITY SECTION:
sics.se. 25309 IN NS fnord.sics.se.
sics.se. 25309 IN NS sics.se.
sics.se. 25309 IN NS a.ns.kth.se.
sics.se. 25309 IN NS brahma.sics.se.
There are (several) TXT RRs, but none contains either v=spf1 nor v=pra/2.0, so sid-milter should ignore these records (without complaining).
The machine(s) we are seeing this on are running NetBSD, uname -a:
NetBSD server 4.0.1 NetBSD 4.0.1 (GENERIC) #0: Tue Oct 7 22:58:48 PDT 2008 builds@wb30:/home/builds/ab/netbsd-4-0-1-RELEASE/i386/200810080053Z-obj/home/builds/ab/netbsd-4-0-1-RELEASE/src/sys/arch/i386/compile/GENERIC i386