Some best practices for DKIM, SPF, and DMARC (as of mid-2015) in [1], including this:
> ...when an organization publishes p=reject [in DMARC], they should simultaneously change their SPF hard fail to SPF soft fail. ... A message that passes SPF and is forwarded will fail SPF. If a message hard fails SPF it will probably be marked as spam but if it soft fails, it will most likely still be accepted by the recipient. This forwarding failure possibility is why most organizations publish a soft fail record.
[1]: https://blogs.msdn.microsoft.com/tzink/2015/07/12/what-is-th...