My read was that networks where traffic originates can and should prevent spoofing (edit: that is, prevent their own networks from sending spoofed traffic, not

My read was that networks where traffic originates can and should prevent spoofing (edit: that is, prevent their own networks from sending spoofed traffic, not prevent others from spoofing their addresses) via egress filtering (per BCP38), whereas the stuff about FooCorp and CloudFlare is about transit/destination networks trying to prevent spoofing via ingress filtering. Did I misunderstand something?