You can fix this by putting a single SPF entry for each envelope/returnpath domain. SPF scales smoothly that way without any need to overload a single top level

You can fix this by putting a single SPF entry for each envelope/returnpath domain. SPF scales smoothly that way without any need to overload a single top level record with entries. This will pass DMARC as well. Very common issue.