As I understand it, SPF works by listing permitted SMTP server domains in the
TXT DNS record of the domain you own.
So if I own
example.com and wish to permit a 3rd-party SMTP server at
smtpexample.com to send emails on behalf of my domain, I add
smtpexample.com to the SPF record, in the
TXT field of my server's DNS entry.
Because DNS is publicly viewable, anyone can see my SPF entry and deduce that I am using
smtpexample.com for sending email.
smtpexample.com were a shared hosting provider, couldn't I sign up for an account with them and send emails purporting to be from
So are the emails are considered legitimate, because they come from the SMTP server which is listed in
example.com's SPF record?