SPF-compliant phishing?

I wrote:

> The current syntax allows SPF to validate the local part on the envelope
> sender. So it can validate users. For example:
>
> mxout                 A       192.168.1.2
> @                     TXT     "v=spf1 exists:%{l}.%{i}.spf.%{o} -all"
> John.192.168.1.2.spf  A       127.0.0.2
> Mary.192.168.1.2.spf  A       127.0.0.2
If you have a lot of IP addresses, then you could do following:

@               TXT     "v=spf1 -include:ip.%{o} exists:%{l}.spf.%{o} -all"
ip              TXT     ("v=spf1 -ip4:192.168.1.2 -ip4:192.168.1.3"
                " -ip4:192.168.1.4 -ip4:192.168.1.5 +all")
John.spf        A       127.0.0.2
Mary.spf        A       127.0.0.2

Roger