Regarding the SPF record, the easiest method, for a single mail server that handles everything on one server with a single IP is:
v=spf1 mx -all
or
v=spf1 mx ~all
This allows the domain’s mx (the server the MX record points to), to send email for the domain and prohibit all others. Of course you could be more explicit, but that won’t gain much, in a single-server scenario, if the MX record already points to the correct server.
See here for a very detailed breakdown of SPF records.
And here for more details about the difference between hard fail -
and soft fail ~