Increasing understanding of return-path and SPF records - email

Question

I have a website with a web form that is hosted with a third party. I'm having trouble with their server config/architecture and wanted to confirm a few things and show the mail headers I am receiving.
I know that I must explicitly set my mail to send through an outgoing mail server and port which I have specified (this is in order for the mail to send, it will not be sent if not sent through the SMTP server).
Upon setting the SMTP server and port here is the mail header:
x-store-info:sbevkl2QZR7OXo7WID5ZcdV2tiiWGqTnhQzu7BHe69dd2ZvcRr0xBttv16txT0x/MHyyxbQQOWxD0k3WKrQDVl56gwTtl9T9YlQDKWZad3R7ZbliBL6BSfw52gpz37cwL/qGTahKP+U=
Authentication-Results: hotmail.com; spf=softfail (sender IP is 213.171.216.60) smtp.mailfrom=test#hotmail.co.uk; dkim=none header.d=hotmail.co.uk; x-hmca=fail header.id=test#hotmail.co.uk
X-SID-PRA: test#hotmail.co.uk
X-AUTH-Result: FAIL
X-SID-Result: FAIL
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtHRD0xO1NDTD0y
X-Message-Info: NhFq/7gR1vSyCjVJ7Q2iIHhF9oW5eW+g+jrtzv+TwMhHX16XKDSEsIIxc1qXk1NO+AwFoToprpXBtEMxyoOvMnJSYUEEN4JngTWWsUg0/J3120nOI8GDZ8sF8m5iNGKuZt7Ds7svv3bOfUNBVLmpGlsbHUCNwXFNgry/rw0sWtsI0nyKa01KIdnxHDoLHp7GPP/klJGbBhJE2FLEW70tX5XZujwdcC9+R5m/pk5uo4uPxfmnwQK9yQ==
Received: from cust-smtp-auth1.fasthosts.net.uk ([213.171.216.60]) by BLU004-MC1F22.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
Mon, 28 Dec 2015 05:59:03 -0800
Received: from fun-booths.co.uk (unknown [88.208.252.229])
by cust-smtp-auth1.fasthosts.net.uk (Postfix) with ESMTP id 923AF74021D
for <c_qatest#hotmail.co.uk>; Mon, 28 Dec 2015 13:59:02 +0000 (GMT)
Date: Mon, 28 Dec 2015 13:59:02 +0000
To: c_qatest#hotmail.co.uk
From: "test#hotmail.co.uk" <test#hotmail.co.uk>
Subject: Fun Booths - Booking form
Message-ID: <918f36d31bf876f19ea6d9563c1ad348#fun-booths.co.uk>
X-Priority: 3
X-Mailer: PHPMailer 5.2.10 (https://github.com/PHPMailer/PHPMailer/)
Reply-To: test#hotmail.co.uk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Return-Path: test#hotmail.co.uk
X-OriginalArrivalTime: 28 Dec 2015 13:59:03.0161 (UTC) FILETIME=[E8B5FE90:01D14177]
Focusing on the Authentication-Results the (sender IP is 213.171.216.60) which is definitely the correct outgoing SMTP server. However the the spf result is spf=softfail.
After doing some research it was suggested that
The Return-Path header is empty. This means that during the SMTP
conversation, the MAIL FROM command did not specify an email address
where bounces are sent. It is the domain from this email address that
SPF tests. If there is no email address, a softfail will result.
Is this referring to the smtp.mailfrom field in the Authentication-Results which is set to a value of test#hotmail.co.uk in the example above?
I believe I have done what is required to implement SPF:
(1) I have set the SPF record in the domain's DNS zone
v=spf1 a ip4:213.171.216.0/24 mx -all
Now the confusion arises here. When someone else's mail server receives a message claiming to come from that domain, then
(2) the receiving server can check whether the message complies with the domain's stated policy
How does hotmail's receiving mail server for example do this check? because if I set a Return-Path of hello#fun-booths.co.uk then this results in spf=pass. Just to be clear www.fun-booths.co.uk is the domain being used.
x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uens6FBov4shFUrwGsQPla5CZKHNFpj4XdT2wfaqUtXggI++7RpfQIpooWW0Sp2ynYP894LLfhswpqbr+Di/ao+0Ofc9Btl/xdHLsTQXTk39KBE=
Authentication-Results: hotmail.com; spf=pass (sender IP is 213.171.216.60) smtp.mailfrom=hello#fun-booths.co.uk; dkim=none header.d=fun-booths.co.uk; x-hmca=pass header.id=hello#fun-booths.co.uk
X-SID-PRA: hello#fun-booths.co.uk
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vTQzco4wDfDIuNexRCLt7KFLQW7EkmNLn/2YehuSC93bNZTp87n+KmseY8TwxSqCjOondyBGOJR9CRbKyT/FU2B2nhMw3SU8HjmnNyAmDcRFqxvARiDy1lMz5O7U5B61WNdLZsDb1vLPQ93l4XO90mQcjMfCI4SWr50rtHEJwK9Y/c2zDWf8jdVXEgQOyBm4pQwu9z7isJFvrHl9HRMGMcWeNHQVVCsFOoqJ8mhQItxPg==
Received: from cust-smtp-auth2.fasthosts.net.uk ([213.171.216.60]) by SNT004-MC2F7.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
Mon, 28 Dec 2015 06:05:27 -0800
Received: from fun-booths.co.uk (unknown [88.208.252.229])
by cust-smtp-auth2.fasthosts.net.uk (Postfix) with ESMTP id 66414740221
for <c_qatest#hotmail.co.uk>; Mon, 28 Dec 2015 14:05:26 +0000 (GMT)
Date: Mon, 28 Dec 2015 14:05:26 +0000
To: c_qatest#hotmail.co.uk
From: "hello#fun-booths.co.uk" <hello#fun-booths.co.uk>
Subject: Fun Booths - Booking form
Message-ID: <85119bedb602f9865290c2ea218315b4#fun-booths.co.uk>
X-Priority: 3
X-Mailer: PHPMailer 5.2.10 (https://github.com/PHPMailer/PHPMailer/)
Reply-To: test#hotmail.co.uk
X-Sender: hello#fun-booths.co.uk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Return-Path: hello#fun-booths.co.uk
X-OriginalArrivalTime: 28 Dec 2015 14:05:27.0582 (UTC) FILETIME=[CDD7FBE0:01D14178]
This leads me on to my final questions - Is it true that the Return-Path must be set to a real email address on the site domain (www.fun-booths.co.uk), or mail will not send?
Because I have set up the mailbox hello#fun-booths.co.uk, however it seems even when I delete the mailbox that this still results in an spf=pass. It seems that in other words that not having a real email address on the domain, and instead just setting the Return-Path to hello#fun-booths.co.uk without the mailbox existing will result in an spf=pass. Should this be the case?
Is the email #fun-booths.co.uk set in the Return-Path used to determine the domain for the SPF checks?
Finally in the quotation above that mentions the SMTP conversation, is the MAIL FROM command referencing the smtp.mailfrom field in the Authentication-Results?

Answer 1

SPF Checks are always done with the envelope sender (MAIL FROM:) - smtp.mailfrom in your case. In the first mail you have test#hotmail.co.uk as envelope sender, but your server is not listed in the SPF record for hotmail.co.uk, and since that record has ~all as the last mechanism you get a Softfail.
In the second mail the envelope sender is hello#fun-booths.co.uk, so it's the SPF record for fun-booths.co.uk that is being used in that check.
So you should use a fun-booths.co.uk address as your envelope sender.
Depending on how you send mail from the web form there are different ways to control the envelope sender, but it may be that value of Return-Path is used as the envelope sender.
There don't have to be a mail-box for the envelope sender for the SPF to work, since SPF normally only look at the domain part of the address, but if the mail bounces somewhere in the process, the bounce message will normally be sent the the envelope sender, so it's a good idea to keep the mailbox for that address.