If I understand http://www.openspf.org/SPF_Record_Syntax correctly, any machine with an IP that points to my-domain.com can send email as if it's from my-domain.com if I'm using
ptr in my SPF record.
Anyone can create a PTR record for his IP(s).
Then isn't it a security risk to use
ptr in your SPF record? It essentially enables anyone to send mail as if it were from your domain.
According to the specification, it isn't recommended to use this mechanism, because it results in many DNS lookups. However, it doesn't say anything about security.
Background: recently, GMail has started marking email (manually sent) from my domain as spam on several accounts. I'm carefully going through my DNS records, server logs, etc., to find the cause and resolve this issue. I removed the mechanism already from my DNS records, but I'm still curious as to why this mechanism doesn't impose a security risk.