Ok, two things:

1.> when I look at cluebringer.conf and i see:
# Modules to load
modules=<<EOT
Core
AccessControl
CheckHelo
CheckSPF
Greylisting
Quotas
EOT

and

# CheckSPF module
[CheckSPF]
enable=1

that doesn't mean it's checking SPF?

2.> in sa > local.cf, if I wanted to whitelist my backup store & forward MX servers, of which there are 2, I can just whitelist their wildcard value (*.domain.com)? remember, i'm NOT looking to whitelist specific sender email addresses but MX servers that may at some point have to relay email to me that was originally intended for me in the 1st place.

Thanks.

ok,

1.> so i read during the install process on one of the option screens that SPF was enabled by default. so you're saying this only applies to how SA uses it?

2.> i use a service, junkemailfilter.com for example, that i input as 2nd and 3rd priority MX records in my domain's DNS records. they capture email and hold it for me should my mail server become unavailable. when my server comes back online, they forward any stored mail to me, so senders to me never get bounces because my server is down and i don't lose any email. but SPF typically breaks this forwarding process since the email isn't coming from the original sender's domain. i just wanted to bypass spf checks for my forwarding service so i don't inadvertently block / reject any legitimate email from them.