we are using Exchange 2010 and have already setup SPF record for our authorized mail server IPs. As a test using our domain name i tried to send an e-mail from another computer on the internet which has an IP which is not listed in SPF record. Other e-mail services rejected the message due to SPF fail but our own exchange accepted it. This tells me that our Exchange is not rejecting e-mail which fail the SPF record. I enabled SenderID on our exchange to reject e-mail which fail senderID but made no difference.
Below is the SPF info i pulled out from the message header which failed SPF but got accepted by our Exchange.
Received-SPF: None (exchange2010.domainname: user@domainname does not designate permitted sender hosts)