There are many valid reasons why someone will send emails "from" a domain they do not control, which
There are many valid reasons why someone will send emails "from" a domain they do not control, which is why the authors of RFC5321 said this:
"Efforts to make it more difficult for users to set envelope return
path and header "From" fields to point to valid addresses other than
their own are largely misguided: they frustrate legitimate
applications in which mail is sent by one user on behalf of another,
in which error (or normal) replies should be directed to a special
address, or in which a single message is sent to multiple recipients
on different hosts."
Purely transactional email services assume that you control your domain; these services are not used for sending general purpose email such as forwarded traffic or discussion list traffic. MailChannels operates a general purpose mail relay service. Only the Cloudflare API is purely transactional, which is why it was appropriate for us to roll out Domain Lockdown there. As for the rest of the infrastructure, we will make it easy for people to use Domain Lockdown if they want to prevent others from sending on behalf of their domain; however, we will caution that doing so will prevent email from their domain from being forwarded - for instance via a discussion list or mail forwarding setup on a hosting box.
"Efforts to make it more difficult for users to set envelope return
path and header "From" fields to point to valid addresses other than
their own are largely misguided: they frustrate legitimate
applications in which mail is sent by one user on behalf of another,
in which error (or normal) replies should be directed to a special
address, or in which a single message is sent to multiple recipients
on different hosts."
Purely transactional email services assume that you control your domain; these services are not used for sending general purpose email such as forwarded traffic or discussion list traffic. MailChannels operates a general purpose mail relay service. Only the Cloudflare API is purely transactional, which is why it was appropriate for us to roll out Domain Lockdown there. As for the rest of the infrastructure, we will make it easy for people to use Domain Lockdown if they want to prevent others from sending on behalf of their domain; however, we will caution that doing so will prevent email from their domain from being forwarded - for instance via a discussion list or mail forwarding setup on a hosting box.
