While the goal of SPF is so you can pseudo-authenticate email from your domain, the problem is that, if you configure your record too tightly, even legitimate mail will fail spf checks on receipt.
In short, a misconfigured SPF record is more dangerous than no SPF record.
The "safe first step" is to list the outbound SMTP servers you know of with + (positive), and everything else as ? (neutral). Email received from your positive-listed server will pass - and theoretically be weighted towards "not spam", and all other email addressed "from" your domain will shrug with an inconclusive result.
"Fail" is an indication that the message should be thrown away, but "softfail" is an indication that the email is questionable - so it might end up in the spam bucket on the receiver side, but still get there.
Since there are some methods for email to be sent legitimately from a server you don't control, e.g. mailing list servers, use of "fail" tends to be avoided. The mail must flow.