I have considered removing SPF rules on my personal domain, as every time someone spoofs my donation to attack corporate emails, their antivirus will incorrectly bounce them all back, at which point they end up in my inbox due to my catch-all; they will then send me a dozen emails complaining about it. The only servers allowed by my SPF is Gmail and one of my personal servers (I usually I use ssmtp, but that doesn't help with software that directly speaks SMTP)