All good points. I would also like to point out that the blog post seems to conflate the "envelope from" (SMTP MAIL FROM) address with the "From: header" addres

All good points. I would also like to point out that the blog post seems to conflate the "envelope from" (SMTP MAIL FROM) address with the "From: header" address without drawing a distinction between the two. This is problematic because they are often different in practice, and while SPF acts on the envelope address, DKIM acts on the header address. The recipient typically only sees the header address in their email software. Because of this, SPF on its own is not very useful as a way to avoid spoofing. It does prevent backscatter, however, because bounces are sent to the envelope address. When a DMARC record is present for the header address domain, the envelope address domain is required to match the header address domain for an SPF check to be considered valid. This makes SPF much more useful when combined with DMARC. Sadly that also makes mail forwarding a harder problem for the same reason - which is interesting given that Cloudflare just started offering an email forwarding service… While these standards are useful to prevent spoofing, a more practical reason to use them is that end user mail services don't tend to like you very much if you don't. Microsoft (Outlook), for example, is notorious for outright rejecting messages if they don't have valid DMARC.