How email spoofing works
The visible From field and SMTP envelope are different parts of a message. That is why SPF PASS alone does not protect a brand.
Header From
This is the name and address a recipient sees. An attacker can place another domain here.
Envelope From и SPF
SPF checks the SMTP-envelope domain, not necessarily the visible From. It authorizes sending systems but does not bind them to the brand without DMARC.
DKIM и DMARC
DKIM signs mail. DMARC requires SPF or DKIM to align with visible From and publishes guidance for messages that fail.