Possible way to bypass SPF Test? - ORF Forums

@Josh: If the sender domain has a bogus / syntactically incorrect SPF record (or, like in this case, multiple SPF records with the same version), ORF will simply skip the SPF test (as it is not possible to determine whether the sender host is authorized to send emails in the name of the domain or not) and proceeds with the rest of the tests. The email will not be excluded from other tests, so it is not possible to bypass filtering this way.

The SPF aims to prevent email forgery, so it helps when a spammer tries to spoof a legitimate, trusted domain. If the domain name in the sender address is bogus or controlled by the spammer (i.e., the spammer can set up an SPF record for it), the SPF test will not be of any use.