SPF: harden against crafted DNS responses