With this article, we will discuss what SPF does and what it does not: Does: SPF authenticates the sending server of the email based on the sending IPv4/IPv6 address. SPF focuses on a header that is not visible to the end-user (Return-Path, MAIL ...
The company's domain will be configured through SPF, DKIM and DMARC records. The third-party vendor will obviously use that domain to send marketing emails.
It stops spoofing of your email domain and after the DMARC record with policy reject is configured, no unauthorized source can send an email on your behalf.