That explains it. The python-spf in Etch Backports doesn't support TCP fallback. It's not actually a bug in python-dns. It's not really a bug in python-spf either since RFC 4408 recommends against publishing records big enough to need TCP, but a missing feature.
The Lenny version supports this, so let me see about a newer backport. Scott K -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]