ok I give up, use the spamhaus list even though it has problems

mailsrv/assets/postfix/main.cf.part

@@ -80,10 +80,10 @@ smtpd_client_restrictions =
 # check if sender meets SPF policy for its domain
         check_policy_service unix:private/policy-spf,
 # reject clients from lists of known spammers
-#        reject_rbl_client zen.spamhaus.org,
-#        reject_rhsbl_reverse_client dbl.spamhaus.org,
-#        reject_rhsbl_helo dbl.spamhaus.org,
-#        reject_rhsbl_sender dbl.spamhaus.org,
+        reject_rbl_client zen.spamhaus.org,
+        reject_rhsbl_reverse_client dbl.spamhaus.org,
+        reject_rhsbl_helo dbl.spamhaus.org,
+        reject_rhsbl_sender dbl.spamhaus.org,
         permit
 
 ### Misc ###

mailsrv/assets/postfix/policyd-spf.conf

@@ -16,7 +16,7 @@ TestOnly = 1
 #  HELO_reject = Null - Only reject HELO Fail for Null sender (SPF Classic)
 #  HELO_reject = False - Never reject/defer on HELO, append header only. 
 #  HELO_reject = No_Check - Never check HELO.
-HELO_reject = Softfail
+HELO_reject = Fail
 
 #  HELO pass restriction policy.
 #  HELO_pass_restriction = helo_passed_spf - Apply the given restriction when
@@ -30,7 +30,7 @@ HELO_reject = Softfail
 #  Mail_From_reject = Fail - Reject on Mail From Fail (default)
 #  Mail_From_reject = False - Never reject/defer on Mail From, append header only
 #  Mail_From_reject = No_Check - Never check Mail From/Return Path.
-Mail_From_reject = Softfail
+Mail_From_reject = Fail
 
 #  Reject only from domains that send no mail. Options are:
 #  No_Mail = False - Normal SPF record processing (default)
@@ -52,7 +52,7 @@ Mail_From_reject = Softfail
 #  Policy for rejecting due to SPF PermError.  Options are:
 #  PermError_reject = True
 #  PermError_reject = False
-PermError_reject = True
+PermError_reject = False
 
 #  Policy for deferring messages due to SPF TempError.  Options are:
 #  TempError_Defer = True