Email notifications for blog comments: from/reply-to set to the commenter's address
When people comment on the CiviCRM blog, the emails have the "from" and "reply-to" headers set to the user's email address. For SPF/DKIM, all notifications should use civicrm.org.
Currently emails sent by the CMS are sent through CiviCRM's mailer (civismtp.com), using the civicrmmailer module. It might need tweaking so that emails are not sent from arbitrary domains, or Drupal might have an option to change how emails are sent (with a valid 'from' and without a reply-to).