Consider DMARC record:
Also consider domain
example.com with a TXT record:
v=spf1 include:_spf.google.com -all
Now imagine a third party sends an email using FROM
email@example.com by either uses an SMTP envelope with a FROM
firstname.lastname@example.org or a return-path of
My understanding is that now the recipient SMTP server will validate SPF using the TXT record at
If this SPF record for mail-sender.com either:
- Does not exist
- Is syntactically invalid
- Permits any IP to send
My understanding is that the SPF TXT record for
example.com is totally ignored and the DMARC record which "rejects" and is in strict SPF alignment mode would not prevent these messages from being delivered successfully (I think these are considered a non aligned SPF pass).
Essentially, am I right to say that there is no such thing in SPF & DMARC to say "only emails from IP's explicitly listed in the TXT record of example.com are allowed to send on behalf of my domain".