If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.
Seems simple:
If your mail/DNS is setup to support either of these, then cool you don't need to confirm.
Else, you must "ok" each post.
DONE