Your SPF setup is currently using a soft fail at the end, which tells receiving mail servers to treat unauthorized senders as suspicious but not automatically reject them. That matters because it gives phishers and spoofed messages a little more room to slip through. Once you’re sure every legitimate sender is included, the fix is to change the policy to a hard fail so unauthorised mail is rejected.