We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM.
A few days ago we noticed that they allow any account with them to send emails on behalf of domains that do not belong to that account. For example, let's say my domain is mycompany.com, and now I want to add mycompetitor.com to my account. This service would now allow me to send emails from @mycompetitor.com.
I brought this up with them and their solution was to no longer "sign" the email, but still allow me to add whatever domain I want. So now I can still send from @mycompetitor.com except that Gmail, for example, would show "via email-sending-service.com". SPF and DKIM would still pass, and the email is not marked as spam.
So, am I being paranoid? I feel that using this email service it would allow anybody with an account to send emails that sort of look like they come from us.
They argue that this is "standard practice" and that anybody with a box somewhere could do the same. But, would SPF/DKIM still pass in those cases?
I feel that by making DNS changes I authorize this email sending company to send emails on my behalf, and then the company goes ahead and allows anybody with an account to send on my behalf (without the signing part); am I off?