What is the impact of the 'from' domain record on SPF when the ESP uses its own domain for the return-path?
Summary
What email marketers say9Marketer opinions
Email marketer from StackExchange user explains that the Return-Path gets SPF checked which is most important for deliverability but the From domain helps improve reputation.
Marketer from Email Geeks shares that often ESP onboarding will instruct clients to add an SPF lookup to the sender’s “from” domain just in case (because of previous SPF/sender-id standards), but the ESP will be using their own domain for the return-path, which has its own SPF record already and so the “from” domain record doesn’t actually have an impact one way or the other.
Email marketer from Digital Ocean explains that ESPs might require certain include statements but generally they use their own domains and the Return-Path record is what matters but the From domain is used for reputation.
Email marketer from Mailgun explains the 'From' domain will be less impactful if Mailgun is using its own Return-Path. However, ensuring DMARC alignment (either SPF or DKIM) with the 'From' domain is still important for passing DMARC checks and improving deliverability.
Email marketer from Email on Acid says that the 'From' domain SPF record is still important for DMARC alignment. Even if the ESP uses its own Return-Path, aligning DMARC with your 'From' domain using SPF or DKIM will improve deliverability.
Email marketer from MXToolbox indicates that SPF record for 'From' domain is less critical when the ESP uses its own Return-Path domain but is still good practice for email authentication.
Email marketer from Reddit user states that when an ESP uses its own Return-Path domain, the SPF record of the 'From' domain serves more as a reputation marker. Failing SPF on the 'From' domain is not ideal, but the Return-Path SPF passing is more critical for deliverability.
Email marketer from Stack Overflow user shares that the 'From' domain SPF record is checked, but if the ESP is using their own domain for the Return-Path, then the SPF check of the 'From' domain becomes less critical. The Return-Path's SPF is what matters most for deliverability in that scenario.
Email marketer from SuperUser forum explains that in general the end user domain owner won't configure there DNS properly which is why services like Google validates your email and that's why DMARC is becoming more important
What the experts say2Expert opinions
Expert from Spam Resource explains that it will be more difficult to be sure where to put SPF records now, if you want to get really technical and you are an e-mail marketer sending on behalf of someone else you need to set the correct SPF record on the Return-Path/envelope from domain, and you will want to set up a DMARC record that uses adkim=s and aspf=s to tell receiving mailboxes they should only accept mail that aligns the DKIM and SPF results with the from domain.
Expert from Word to the Wise responds that what matters most is that the Return-Path passes authentication, which is typically controlled by the ESP. The 'From' domain reputation is less important when the Return-Path passes authentication.
What the documentation says5Technical articles
Documentation from SparkPost explains that the Return-Path domain's SPF is checked for initial SPF verification. If the ESP uses its domain, that SPF record must pass. The 'From' domain's SPF may still be considered for reputation and DMARC alignment.
Documentation from DMARC.org explains that SPF authenticates the 'Return-Path' domain. If an ESP uses its own 'Return-Path', the 'From' domain SPF is less relevant for initial authentication. DMARC alignment, however, can tie the 'From' domain to the authentication results.
Documentation from Google Workspace Admin Help explains that even if the 'From' domain fails SPF, if the Return-Path domain passes SPF and DKIM aligns, the message can still pass DMARC if the DMARC policy is set to allow it.
Documentation from RFC specifies that SPF authentication is primarily based on the 'Return-Path' domain.
Documentation from Microsoft suggests that to help prevent spoofing, you should configure SPF, DKIM, and DMARC records for the primary email domain.