Does your application check DMARC alignment? Otherwise, a spoofed 'from' address will pass through. And also the sender's policy alone is not enough because, gmail.com and outlook.com have DMARC p=none.