I'm trying to work through properly configuring SPF for my domain. We have two MX servers that only receive mail, and two outbound relay servers which we expect to list in our SPF record.
We also have a mail server in a subdomain called mail.sub.example.com. It only sends mail for this subdomain. The two MX servers are also responsible for incoming mail for this domain.
The problem I'm having is users often forward their mail off this subdomain server and on to Gmail and other providers, where they use the features of these remote providers to send mail as firstname.lastname@example.org.
Would it then be advisable to add Google's SPF record as an include?
I'm concerned that doing this will open up all of Google to be able to spoof my domain. If it's not listed, we lose the benefit of maintaining the security SPF provides throughout the entire email chain.
I'd also like to benefit from the SPF protection when receiving an email to one of the MX servers from my own domain, and using it to protect my own users from receiving a forged email from a user in our domain.