Danny,

If a system is checking the email headers, that is wrong and here is why.

• A Received header is always added by the receiving server. Consider the following example:
  • userA@xyz.com sends an email to friend@abc.com. This message goes to xyz.com's SMTP server. There are no received headers at this time in the email messages
  • The first received header is added by xyz.com's SMTP server containing userA's local IP address, which could be 192.168.1.x
  • When abc.com's SMTP server receives this message, there is ONLY ONE received header in the email, which is for 192.168.1.x. The second Received header will be added by abc.com's SMTP server and will most likely contain the IP address of xyz.com's SMTP server. This IP address is extracted from TCP/IP packet header not email header.
  • If xyz.com publishes their SPF record, there is no way the SMTP for abc.com can parse the header because it is not there yet.
• Therefore, an SPF lookup should never rely on RFC 822 headers.