Why does SPF alone not prevent spoofing?

Because modern phishing relies on the visible sender. SPF authenticates the envelope, which is invisible to users.

This is why DKIM and DMARC are required for true protection.

Was this answer helpful?

Thanks for your feedback!