Your SPF setup is working, but it ends in a softer “fail” mode, which means mail from unlisted senders may be treated as suspicious instead of being clearly rejected. This matters because it is a little less strict than ideal and can leave more room for spoofed mail to slip through. If you’re sure every legitimate sender is already included, the fix is to tighten the SPF policy so unauthorized senders are rejected outright.