What SPF permission to a third-party ESP means for your brand
What a domain with an SPF record that authorises a third-party ESP means for your brand is simple: it has delegated sending authority. The permission supports genuine campaigns but extends the trust boundary to infrastructure the brand does not directly control.
SPF is one DNS-based check. It does not authenticate the visible From address by itself, validate content, or stop a phisher copying a convincing sender name. DKIM, DMARC and operational controls determine the assurance a receiver gains.
For Australian teams using Microsoft 365 or Google Workspace, the distinction matters. Campaigns may run through Marketo, Salesforce or another ESP while appearing to come from a Sydney or Melbourne company, so receivers must connect the visible brand, signing domain and authorised sending path.
What the SPF permission actually says
An SPF record is DNS TXT data, usually beginning v=spf1. An include: points to another domain’s SPF policy, while ip4: and ip6: name direct senders. Receivers evaluate the chain against rules such as -all; SPF permits no more than ten DNS-querying terms while evaluating a message.
The check starts with the envelope sender, or MAIL FROM, not the From address in the inbox. With a customer-controlled bounce domain, SPF can align with the brand. With a shared provider domain, it may pass for the provider while failing DMARC alignment.
A phisher can publish a near-identical SPF policy on a lookalike domain, so identical DNS text does not identify the real sender. This explanation of copied SPF records compares the envelope domain, visible sender and authentication results rather than trusting the record alone.
Why the permission affects spoofing risk
Authorising an ESP does not make every message from its infrastructure trustworthy. A compromised campaign account, stolen API credential, broad sending range or stale vendor entry can give an attacker a path that passes SPF. The include identifies where trust has been placed.
Brand risk differs from deliverability. An abused ESP account can send a plausible invoice or password reset, and SPF may pass because the infrastructure is authorised. Staff should verify unexpected payment or account-change requests through a known channel even when the sender domain looks exact.
The Spam Act 2003 sets consent and unsubscribe requirements for many commercial electronic messages sent in Australia. Personal information handled for campaigns may also fall under the Privacy Act 1988 and Australian Privacy Principles. Vendor contracts should reflect access, retention and breach responsibilities.
How SPF, DKIM and DMARC work together
SPF answers one narrow question: was the envelope sender published by the consulted domain? DKIM asks whether the holder of a private key signed the selected headers and body. Its d= domain matters because a valid signature from an unrelated ESP domain may not align with the brand.
DMARC combines alignment with policy. A message passes when aligned SPF or DKIM matches the visible From domain, after which p=none, p=quarantine or p=reject can apply. A sound rollout monitors first, moves to quarantine, then rejects after legitimate senders are corrected.
Both checks can pass while the visible sender is fraudulent if an attacker controls a lookalike domain or compromises the authorised service. Trusted Sender Score checks domain reputation and authentication, and its API can place results in approval or monitoring workflows for help desks and finance teams.
Auditing ESP access across the organisation
Inventory every system that can send email: marketing platforms, CRMs, receipts, ticketing tools and hosted help desks. Trusted Sender Score can audit vendors in batches, and its guide to bulk vendor lookups explains how to review domains that send on a brand’s behalf.
For each sender, record the owner, MFA status, API scope, data accessed, and domains used for MAIL FROM and DKIM. Remove unused include: entries, but stage changes so legitimate mail is not dropped. Ask each ESP which ranges and subdomains its policy authorises.
Australian SMEs often combine a local .com.au domain with Microsoft 365, Google Workspace or HubSpot. This creates several legitimate paths but makes stale permissions harder to spot. Reviews should cover former agencies, contractors and dormant campaign domains, not only the current vendor.
Making the permission measurable and repeatable
Measure the desired state: known ESP sources, valid aligned DKIM, enforced DMARC and no unexplained sender domains. Test each real campaign, including mobile inboxes and forwarding systems, then revisit results when a vendor changes its SPF record. Free bulk checks and API integration support repeatable controls for lean teams.
Benchmarking can reveal common gaps without labelling a domain unsafe. The review of weak authentication patterns helps Australian teams compare local domains with global SaaS platforms. Investigate domains that lack DMARC or publish an unexpectedly broad SPF policy rather than judging them by volume alone.
The practical controls answer different questions and should be read together:
| Signal | Healthy result | Misleading result | Brand action |
|---|---|---|---|
| SPF | ESP sources are included and the lookup chain is within the limit | A pass says nothing about content or the visible identity | Confirm the envelope domain and delegated includes |
| DKIM | The signature validates and d= matches the brand |
A valid signature does not mean the message is safe | Require alignment and rotate exposed keys |
| DMARC | Aligned SPF or DKIM passes under an enforced policy | Authentication cannot prove the sender’s intent | Move from monitoring to quarantine, then reject |
| Vendor access | Only approved ESP accounts can send | A reputable ESP can still have an account abused | Review MFA, API scopes, logs and data access |
A narrow ESP delegation combined with aligned DKIM and enforced DMARC gives receivers verifiable evidence without pretending that authentication alone can judge intent. Brand protection comes from connecting those technical results to disciplined vendor access and timely verification of unusual requests.