* Dick St Peters:
Softfail is not "debug", it is (among other things) a hint to
Spamassassin and similar scoring systems. A softfail adds to the
score, but it doesn't add as much as an outright fail.
Does this reflect existing practice? (I think that Fail == SoftFail
is a common configuration, but I'm not sure.)
The wording in the spec also gives me a different expectation.
Domains with a lot of users sending mail from a lot of places (such as
airports, hotels, libraries, internet cafes, etc.) cannot possibly
list all the possible sources of legitimate mail from the domain, nor
would they want to say all mail from these places is authorized.
Is this a real problem? Most hotspots don't provide a mail relay, and
typical MUAs do not include full-blown MTAs. In other words, you have
to relay mail through the ISP's smarthost anyway, and SPF wouldn't
notice the difference.