So I just succesfully set up postfix + dovecot. is SPF enough to make sure emails get delivered to my website's users?
I don't want my emails to end up in their spam box.
SPF can contribute depending on the way the recipient mail server has been setup. Generally I have seen it being used to weight a message as non spam, not act as a singularly decisive factor. DKIM will also help in the same way.
Having said that, the best way of your mail being treated as legitimate is to ensure to basics are covered
you can check how a mail will be interrogated (with some handy DKIM and SPF validity checks) by sending an email to firstname.lastname@example.org - it will send back an automatic mail report.
SPF is a mechanism for indicating which servers are allowed to send mail on your behalf. But it says nothing about whether or not YOU will be sending SPAM. And remember, it's the receiving server's decision what to do with the information it has and whether to accept your message -- they can make that decision based on any criteria they please.
Most servers take the following points into consideration:
That last point is one that many people don't take into consideration -- if you don't normally send much email, and then you send out a newsletter as a single "blast", your email will have a much lower delivery percentage. You're significantly better off sending out email in a constant flow with a slow ramp-up rather than sending out a single mass-mailing. When large companies need to alert their entire customer base about something (like Sony last week), it often takes days to get the message delivered to everyone.
There's no way to 100% certain that a legitimate email from your domain won't be treated as spam by some receiving domain or user.
Having valid SPF records is, however, a critical step in reducing the chance that emails from your domain will be treated as valid. You should also look at DKIM as another method.