Consider DMARC record:
v=DMARC1;p=reject;rua=mailto:xyz;ruf=mailto:xyz;adkim=s;aspf=s;pct=100;fo=1;sp=reject
Also consider domain example.com
with a TXT record:
v=spf1 include:_spf.google.com -all
Now imagine a third party sends an email using FROM [email protected]
by either uses an SMTP envelope with a FROM [email protected]
or a return-path of [email protected]
.
My understanding is that now the recipient SMTP server will validate SPF using the TXT record at mail-sender.com
.
If this SPF record for mail-sender.com either:
- Does not exist
- Is syntactically invalid
- Permits any IP to send
My understanding is that the SPF TXT record for example.com
is totally ignored and the DMARC record which "rejects" and is in strict SPF alignment mode would not prevent these messages from being delivered successfully (I think these are considered a non aligned SPF pass).
Essentially, am I right to say that there is no such thing in SPF & DMARC to say "only emails from IP's explicitly listed in the TXT record of example.com are allowed to send on behalf of my domain".