[nashashmi]

SPFs are not a legal enforcement and a court cannot penalize an entity for not having an SPF.

It is sort of like saying "because you are not sending encrypted emails, you are purposefully and negligently jeopardizing your privacy and information security."

[Alex3917]

> It is sort of like saying "because you are not sending encrypted emails, you are purposefully and negligently jeopardizing your privacy and information security."

Of course a court can say that. The phrase used to describe email is literally like a postcard. If you sent out HIPAA or FERPA protected information on a postcard, would you really expect not to pay a huge fine or go to prison?