My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted IP addresses sends an email, the receiving server could perform the TXT record lookup on the from domain and inspect the record to help determine whether it should soft fail or hard fail an inbound email.
dig my-site.com TXT "v=spf1 include:_spf.google.com include:servers.mcsv.net -all"
I thought that this record was basically saying "allow any servers indicated by the TXT record found at spf.google.com or servers.mcsv.net and fail anything else.
Do I need SPF? No, Intercom handles that for you. Emails sent from Intercom include a return-path header. When a recipient mail server receives one of our emails and checks the SPF record of the domain in our return-path, they will see that our sending IP addresses are authorized senders. This means emails sent through Intercom will pass authentication automatically and you don't need to set up any records yourself.
This confuses me. Doesn't this mean that intercom in this case (also anyone on the internet using the same technique) can send an email that appears to come from
my-site.com despite the fact that I have used an SPF record which is supposed to fail anything that isn't in my set of white-listed IP addresses? Wouldn't the person receiving the email see this as being "from"
firstname.lastname@example.org AND as an SPF pass, even though the sending server's IP address may not have been one of my authorized IP addresses?
Note, I do use DKIM and DMARC as well - but I want to isolate this discussion to just the SPF side of things.