Why does my postfix reject mail with a spf hardfail even though spf DNs record is set to softfail?
This was actually a misconception on my side. I assumed that the sfp entry of remotemailserver.de is checked. But it is the mail server of the FROM field which is checked.
In this case the sfp records of gmx.net is a -all record which means I get a hardfail (correctly).