Personally, having implemented it and then given up, I think the only useful application for
SPF is whitelisting. If you score based on SPF pass or fail and this increases your false
positives/negatives there is no point using it in this way, unless your objective is to punish
people for incorrect or unmaintained SPF setups. However, if you have whitelisted the domain
as having a well-managed mail system then SPF can give you some confidence a message from a
particular IP address is from that domain.