I read an article today (that I already lost the link to) that was talking about how spammers are using SPF on their throw away domains and domain administrators are using SPF incorrectly. Their conclusion was that SPF or Sender ID was not a good technology for fighting spam.
Personally I think they didn’t get the point. SPF is one technology for fighting spam, not the only technology. If SPF can be used to filter out some email then it will work for what it is designed to do.
As for the people who don not have SPF configured properly or they having users who are not using the authorized server, how is this a problem with the technology. Greater adoption of SPF would eventually root out these problem, as domain admins get reports of problems from their users.
Right now I am getting one type of spam that is driving me crazy, spam from my own domain name that is not originating from my servers. SPF is the perfect technology for this category of spam, where RBLs and bayesian filters are better for other types of spam.
In the end, no one anti-spam technology is going to win the battle. But a toolkit of technologies that work together each solving a distinct part of the problem will stem the tide and again make email the killer app that is was.