Reading up on the SPF spec, I understand that SPF designates certain IPs as valid sender SMTP server IPs. For Google Apps, the SPF record is supposed to be v=spf1 include:_spf.google.com ~all
.
The way I read this, it means allow ANYONE with a Gmail/Google Apps account to spoof an email address from my domain name.
So how does this really reduce spam? Is the assumption here that spammers don't/can't create throwaway gmail addresses?