DMARC actually evaluates your SPF result, looking for a PASS, as well as alignment between the
smtp.mailfrom domain and the
header.from domain. As long as SPF does not produce a pass, (whether you have
-all mechanism at the end), DMARC will not consider the SPF result a PASS.
The same holds true for DKIM. The
header.d domain should align with the
header.from domain and the result should be PASS.
However, and to answer your question partly, some servers will interpret an SPF hard fail (
-all) as a reason to reject your emails, even though it passes DMARC on DKIM.
On the other hand, not all receiving servers check on DMARC. So an SPF soft fail (
~all)will not cause an email to be rejected on it's own (generally speaking). At the same time SPF is not the greatest tool for protecting against spoofing, since SPF is checked on the
smtp.mailfrom domain instead of the
header.from domain, and only the latter is visible to the recipient (in most client software). And thus the alignment requirement in DMARC.
In terms of what is better for forwarding: it depends. Some forwarders will rewrite the
snmtp.mailfrom), which will fix SPF, but break DMARC alignment. Others will, for example, add a piece of text to the
subject field which in turn will break the DKIM signature (if the
subject was one of the signed headers). It's not so clear-cut. Authenticated Received Chain (ARC) is a protocol that is helpful in this respect, be it still in development.
My advice would be to use SPF with a soft fail mechanism and use DMARC with a reject policy. Also, use SPF and DKIM complimentary for optimal results.
My opinion: You're publishing a clear directive in DMARC. It is up to the recipient to implement corresponding checks. In fact, a receiving server can be configured to completely ignore both SPF (hard) fail and DMARC reject policies. That's not the senders responsibility, but the recipients prerogative.