An SPF record is a DNS record that essentially states which IPs/domains are allowed to send email on behalf of the domain.
When using a third-party email service, the service often recommends using a "catch-all" SPF record for all of their servers. Here's what Sendgrid recommends:
v=spf1 include:sendgrid.net ~all
The domain that this record is associated with (e.g. example.com) will "allow" all email from all of sendgrid.net's domains.
It seems to me that an attacker could simply register for a Sendgrid account and send emails on behalf of example.com that would "pass" the SPF check.
Is this true?
I know that SPF isn't designed to verify message authenticity. It just seems a bit odd that in the right situation, such a widely-lauded technology has such an easily-exploited weakness. And yes, I do realize that requesting a private IP from the third-party email service would alleviate this concern.