I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "[email protected]", the receiving email server would query DNS records for atte.com and verify that the server which is sending mail is allowed to send mail for this domain.
But today I came across this article, which claims that nowadays email servers don't care about the "from" domain's SPF record - instead, they care about the "Return-Path" domain's SPF record. The "Return-Path" header is used for bounces etc. and is generally not visible to email recipient. Doesn't this makes spoofing trivially easy?
My question is: is the information provided in the article correct or am I potentially running into deliverability issues if my SPF record is not listing the sending server as an allowed sender? Note that I'm not asking a question about a theoretical world where everyone adheres to standardized protocols, but rather a practical question about the actual world where email providers have extremely aggressive proprietary spam filtering systems.
Edit: This is not a duplicate. Because I was requested to do this, I will go through the linked "possible duplicates" 1 by 1 below:
The question linked above is asking why set up DMARC if SPF and DKIM are already set. This is entirely different from my question "how do most common email providers use the SPF record in 2019".
The question linked above is asking what are the advantages of DKIM, if SPF is already set. So a completely different question again.
The question linked above has practical relevance for me, since it answers the issue that I have in practice. However, it does not answer the question I posted here. The question I posted implies that the SPF record is not set, which is clearly different from the situation where the SPF record is set.