In practice difference between SPF softfail and SPF hardfail is less significant than in theory (where everyone follows RFC7208 to the letter). Many mail system

In practice difference between SPF softfail and SPF hardfail is less significant than in theory (where everyone follows RFC7208 to the letter). Many mail system don't reject a message in case of SPF fail - SPF result is used one of many inputs for an anti-spam system. If we have SPF pass we can assume that a message was sent from an infrastructure approved by the domain owner and if domain has good reputation we can take it into account. If we don't have SPF pass then the sender address in the message can be spoofed. Be it SPF softfail or hardfail or even a missing SPF record we cannot trust the sender address. But if otherwise message looks good it still can be accepted. DMARC makes things a bit more complicated but it is similar - either you have DMARC pass (which is good) or you don't have it and why exactly you don't have DMARC pass is less important.