Ask HN: Time to start rejecting SPF soft fails?

With the rise of phishing and forgeries, is it safe to continue accepting emails which soft fail the sender's SPF policy?

Is it time to start rejecting soft fails with a clear bounce message, rather then silently sending soft fails to the spam folder?

Two thirds of our soft fails are obvious forgeries and phishing attacks and spam, but one thirds are legitimate senders with poor sending infrastructure who would be impacted.

Should we continue to tolerate misconfigured SPF policies, and let the clients of misconfigured sending ISPs believe everything is well, or should we start to make a change towards a safer email environment?