move the SPF check to "MAIL FROM" from "DATA"