I actually noticed yesterday that apparently G Suite customers can email Gmail accounts using domains with invalid SPF records (set to hardfail if not from a di

I actually noticed yesterday that apparently G Suite customers can email Gmail accounts using domains with invalid SPF records (set to hardfail if not from a different mail service). I thought that was very odd. It seems that Google assumes G Suite's domain validation process is adequate, and doesn't bother checking SPF records for mail internal to Google's infrastructure. The flaw reported in this article depends on this apparent decision. Whilst this general choice may not be the gaping security hole it feels like, because G Suite validates domain ownership, it does lead to people setting up G Suite, configuring their MX records (G Suite doesn't make SPF obvious to a new account, when I did it a few months ago for someone), and then people may email back and forth with a personal (likely Gmail) account to test it works. Then, when they email someone with another mail server, they blame us when their SPF record is configured to block G Suite.