Comment by madisp

I think in this case it's the customers of their customers, e.g. people sending emails to [email protected]. In that light requiring all emails coming into [email protected] to have SPF and DMARC is bad for business indeed, not only for Zendesk but probably also for the fictional ACME corp.

EDIT: they absolutley should not use an autoincrementing int as a "support-chain token" though, that's a workaround they could easily do.