Definitely. SPF is a bofh type option. Shouldn't be too hard to implement for someone who understands C/C++ (which I do not, unfortunately). If the option is enabled in bofh, just check to see that an SPF record exists, and if it does, reject the message as spam if it comes from an unauthorized source. That way, SPF will essentially "work" for domains that use it, but still be backwards compatible with those who don't.