I've had some contact with a big client e-mail filter, (30k+ users) and we chose to expose a soft SPF in the external DNS and a hard SPF in an internal DNS used

I've had some contact with a big client e-mail filter, (30k+ users) and we chose to expose a soft SPF in the external DNS and a hard SPF in an internal DNS used as a cache by the mailfilter. This was a workaround because the big org had countless 3rd party suppliers of services who many times wanted to mail as @big.corp. And this was fine when mailing to big corp as we could whitelist their senders in the SPF service config, but when mailing to the rest of the internet like gmail, yahoo and hotmail we needed a soft SPF fail instead of having to add those countless servers in our DNS record.