I think we can all agree that SMTP is incredibly broken in today's world of spam. But it's also incredibly widespread. SPF is a hack, and one which just plain won't work very well for domains where anybody can have emails on it, because people are used to being able to do what they like. It's like asking everybody to switch to IPv6; it's just not going to happen.

What's needed is a new system entirely. But that's not going to happen, either. Really, for domains like dreamwidth.org, there's not much of a choice.

The one thing that would help would be to make 'official' emails come from a separate subdomain, say official.dreamwidth.net, and then put an SPF entry on that to say they can only be sent by the Dreamwidth server. And then hope that spammers send only to mail servers that check SPF...