This question already has an answer here:
I'm trying to set up SPF for our domain to prevent or reduce spoofing. The difficulty I'm having is with how to look at any particular email and determine if it would pass SPF.
We of course know which internal mail servers we have that are sending mail for our domain. The problem is finding the external ones, like constant-contact, etc, that have been used by the marketing folks to send mail as users in our domain that should be included in our SPF record.
I understand it analyzes the "MAIL FROM" data and references it with the IP address of the connecting server. Often times I see "MAIL FROM" something like "email@example.com" but the mail is actually "From:" firstname.lastname@example.org" yet it passes SPF.
When checking to see if a particular email would pass an SPF test, how is the "From:" field considered, when "MAIL FROM" is the real return-path sender?