Recently I was reading about the Sender Policy Framework (SPF) record syntax on OpenSPF.com.

> 
> Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators. - [Wikipedia](https://en.wikipedia.org/wiki/Sender_Policy_Framework)
> 
> 
> 

I noticed that the SPF syntax allows us to use the "exists-mechanism". The following is given as an example:

> 
> In the following example, the client IP is 1.2.3.4 and the current-domain is example.com.
> 
> 
> `v=spf1 exists:example.com -all`.
> 
> 
> If example.com does not resolve, the result is fail. If it does resolve, this mechanism results in a match. - [OpenSPF.com](http://www.openspf.org/SPF_Record_Syntax)
> 
> 
> 

If I'm correct, only `example.com` is allowed to send email, all other senders are marked as SPAM because of the fail `-all` flag. Let's assume that I used the above SPF-record on the domain `example.org`.

*So, `example.org` allows `example.com` to send emails in name of `example.org`.*

Now let's assume the the domain `example.com` expires and is free for registration again and the above SPF record on `example.org` stays unchanged (read: pointing to example.com). In this case the SPF record of `example.org` will fail on all email since the only allowed domain doesn't exist anymore.

Now if an attacker registers the available `example.com` domain. Then he is able to send SPAM in name of example.org, while the SPF record won't stop it from doing so?

*In other words, should the use of the SPF exists-mechanism be marked as a potential risk? Or, does the use of the SPF "exists" mechanism introduce a security risk?*

*The same applies to `include:`, `ptr:`, `a:` and `mx:` when they point to an non registered domain.*