Ehlers, Y.W. (Ydo): > This usage of a single SPF record results in an existing domain from > Postfix's? perspective.
Nope. It has nothing to do with SPF. Instead, it's a borked DNS
server.
reject_unknown_sender/recipient_domain looks for MX, A, and AAAA
records (if compiled with IPv6 support).
With hotmail.co, lookup for MX, A or AAAA results in SERVFAIL,
therefore Postfix decides that the domain status is unknown.
Instead of SERVFAIL, the DNS server should reply with NOERROR.
Wietse
