Suppose I activate SPF in my environment. I am now strictly enforcing SPF records from sending domains. There are many execs in the company who like to forward news stories from CNN and such to their co-workers. When I send the article, CNN asks me for my email address and the email addres of the person I am sending it to. So I fill out email@example.com in the sender addres an firstname.lastname@example.org in the to address. Now my DNS records for somewhere.com only lists the two SMTP servers at my company (as it should). The email comes in from CNN's SMTP server and is blocked since its IP is not registered in my SPF record?
This is one 'drawback' I see to SPF. Is the practice of sending emails from web sites like this not a good idea from a security standpoint? Are there any other potential issues with strictly implementing SPF?