I don't think there's a single "correct" answer here, since varying implementations do different things. I've been using fail with all domains I administer for

I don't think there's a single "correct" answer here, since varying implementations do different things. I've been using fail with all domains I administer for over 10 years without issue. What really matters is properly configuring DKIM and DMARC.