We make use of a unique return-path email on all email sent to track bounce backs and give feedback, but recently we're getting issues where the SPF record fails because people are allowed to send through their own domains and SMTP servers and then obviously our SPF records are not set up to allow those IP's.
So basically the from email is not used by the other mail server to check for SPF but the return-path mail, is there any way to set up my SPF record so the mails where the return-path is set to our domain can go through but people can't just spoof the domain?
Here is one of the bounce backs:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:
host mx11.mailzone.co.za [188.8.131.52]
SMTP error from remote mail server after end of data:
550 184.108.40.206 is not allowed to send mail from itensityonline.co.za. Please see http://www.openspf.net/Why?scope=mfrom;firstname.lastname@example.org;ip=220.127.116.11
But like I said the return path is from that domain but not the from address.