Am I correct in assuming that ESPs can achieve DMARC-SPF alignment pass by requiring a CNAME record pointing to the ESP’s servers (e.g. whatever. customer. net CNAME bounce. ESP .com) instead of asking for a SPF include?
The ESP can then set a return-path like customer.ID[@]whatever.customer.net, and still be able to handle bounces. SPF will be checked against the record at whatever. customer. net (which is controlled by the ESP at bounce. ESP .com, and separate from yet aligned with SPF at customer. net).
Unfortunately, very few ESPs do that.
