SPF not correctly checked on multiple from addresses

[Tim Schneider]

I recently received SPAM a mail that claimed to be from one of my own domains. Since I have SPF activated I believed this to not be possible. After analyzing the e-mail, I found out, that the sender used a trick to circumvent the SPF protection:

He simply put multiple from addresses in the e-mail like so:
From: <email address hidden>, <email address hidden>, =?UTF-8?Q?f=C3=BCr=20?=<email address hidden>, <email address hidden>, -=?UTF-8?Q?=E2=82=AC?=! <email address hidden>

After looking in the RFC (https://tools.ietf.org/html/rfc2822#section-3.6.2) I found out, that it is actually allowed to put multiple "From" addresses in one e-mail.
It seems like the SPF was only checked for the last email with the mail address in '<>' and for none of the previous e-mail addresses.
I would think, that the SPF would need to be checked for all From addresses, as it is otherwise easy to circumvent SPF partially by simply adding another email address at the end of the list.

[Scott Kitterman (kitterman)]

SPF does not check the From identity in the body of the message. It checks the Mail From in the envelope of the message (and there can be only one of those). See the introduction to RFC 7208 [1].

[1] https://tools.ietf.org/html/rfc7208#page-5