Every permissive setting in this stack fails in the same direction, which is delivery. Softfail marks the message and hands it over [4], neutral states no opinion at all [5], `p=none` reports and delivers [9], and `p=reject; pct=20` enforces on one message in five while the other four go through [12]. That last one is 80 percent of exactly the mail the policy was written to stop [16]. Of the four qualifiers available on SPF's `all` term, three produce no rejection [17], and the one that does is the one you never reach by leaving the rollout setting where it is [3][4].
The ten-lookup cap is what turns a one-time setup into a decaying asset. RFC 7208 stops SPF evaluation at ten DNS lookups, and each vendor `include:` can cost one or more [7]. Take the friendly case where every vendor costs exactly one: ten includes puts you level with the cap, and the eleventh sender you onboard puts you over it [18]. Nested includes mean ten is a ceiling nobody actually reaches. Past the line, receivers return PermError and abandon SPF evaluation entirely, and nothing in your DNS changed to tell you [7][8].
There is a second-order effect the post does not follow through. DMARC acts on messages that fail both SPF and DKIM [13]. With SPF in PermError there is no SPF pass available to align, so every DMARC pass has to come from the DKIM signature [19]. A domain in that state can be publishing `p=reject` and running on one leg, and the record text still reads as strong.
Worth naming what this material is. It is a Merlonix blog post republished on dev.to [20], and the supplied text breaks off mid-sentence in the DKIM section [21], so DKIM here amounts to the description of how signing and key publication work [14] and nothing about how it gets left half-configured. The two switches it does document are enough to work with, because both live in text you publish yourself rather than in telemetry you have to buy. The reason so many domains sit unenforced is not obscurity: permissive modes exist so a rollout does not bounce your own legitimate mail, and "published it in monitor mode to watch first" is indistinguishable from "finished" to any tool that only looks up whether a record exists [15].
