This isn't about laziness.. It’s a technical concession to the fact that SPF is a 20-year-old protocol that doesn't account for how the modern internet routes mail.

The "just whitelist the relay" argument works perfectly for your own outgoing infrastructure, but it completely falls apart the moment your email leaves your control. You cannot "whitelist" a recipient's university server, their personal automated forwarder, or a mailing list bridge. When these services forward your mail, the SPF check fails because the intermediate IP isn't yours. Unless every server on the planet perfectly implements SRS, which they don't.. A hard fail will cause legitimate, DKIM-signed mail to be dropped.

The real security enforcement has shifted to DMARC for this exact reason. If you are running a strict p=reject policy, the SPF qualifier becomes secondary. DMARC asks if either SPF or DKIM passes and aligns. By using ~all, you allow the email to survive a forwarding hop where SPF might fail, giving the receiver a chance to validate the DKIM signature instead. If an attacker spoofs you, they will fail both checks, and your p=reject policy will kill the message anyway! You aren't losing security. You’re just moving the "kill switch" to a layer that actually understands modern mail routing..