SPF is not too bad as far as forging countermeasures work. It's relatively simple both to implement and to check. I'm not against it.
What I don't like is every single other standard they pushed later. I personally think DMARC is borderline useless. DKIM is plainly horrid and breaks just about everything you'd expect from email such as mailing lists, while not solving anything both from a legitimacy perspective and from a spam perspective.
Like everybody says, the "recommended" solution is to pour each and every of these half-assed solutions into a score system. Which sucks, because when a legitimate email is rejected, the fix is never trivial: it could be just a perfectly legitimate host which decided that all these solutions are crap (and they're right).
You know my current 90+% spam and scamming source by volume? It's gmail.com. It's passing all these checks, of course. It's the reason I consider DKIM virtually useless even from a legitimacy perspective: a valid DKIM signature from any large/free email provider bears no significance to the point that even if I had a decent UI for validation in my email client, I would basically have to avoid it: "oh, right, another legit scam from gmail.com".