move SPF check back to "DATA" processing