In practice, when an email system encounters a CNAME, it will follow the CNAME and query the target's TXT to find out the SPF rules.

But I didn't find an RFC document that clarifies this behavior. Hmmmm