We use a paid-for bulk emailing service for our business operations and we've added that service to our own SPF record so that it may masquerade as someone from our domain for what it'll be asked to do for us:
//18.104.22.168 is replaced with our public IP v=spf1 a mx ip4:22.214.171.124 include:bulkmailer.com ~all
Sometimes we let clients use our platform in a whitelabelled sense, themed to match their own website. They want the emails our platform sends to bear their own domain name instead of ours and classically we've recommended that they add the paid-for bulk mailing service that we use into their own SPF record, so that when we use the bulk mailer, and claim to be email@example.com everything is all fine (I've no idea what we send for HELO/EHLO in in this situation):
v=spf1 a mx include:bulkmailer.com ~all
This concerns me though, that essentially then it's opening up the possibility that any other customer of the bulk mailer acquires the ability to pass themselves off as our client. I'm wondering whether an IP should have been included in the SPF we told our customer to apply, that would restrict things such that only we (our public IP) may masquerade as the customer?