I've had a issue where a client added their own domain as trusted domains and they have a SPF with a -all flag.  Someone sent them a email using their own domain as the from, and of course it came through regardless of the SPF flag.  I see the option of Enable for Incoming SMTP blocking, but, I have NO idea on what values it'll block at, or if that even works? Nothing in the documentation either about it.