The receiving email server looks for the Return-Path address of the email. This also happens to be the address used to send a message back to the sender if the email bounces. (You might also hear this called the envelope sender, mail from, or bounce address too.)

If you're curious about what this actually looks like, open up an email's raw source code, then look for the Return-Path header. It'll look something like this:

The receiving email server finds the SPF record based on the domain of the Return-Path, pm-bounces.dnsdigest.com. That's the SPF record in the dnsdigest.com DNS record set with the hostname of pm-bounces.

This isn't the only time this SPF record might get used.

Alternatively, if the SPF record being used contains include:pm-bounces.dnsdigest.com in its value, it's telling the receiving email server to also check this SPF record to validate the email is coming from a valid source. Here's a made up example:

This is why, when you are sending email from a third-party email provider, you're often asked to "include" their SPF record in yours, so all of the servers they permit are added to your SPF record.

Correct. For SPF, email servers are not looking at the displayed From address of the email. They're looking at the Return-Path address.

This is why a DMARC record is important. DMARC authentication requires that the domain of the displayed From address matches the Return-Path address (what's called "SPF alignment").

Head over to the DMARC section to dive into your DMARC records.