SPF checking is not enforced by default. To take advantage of the SPF checking on our system, there is 2 steps:
Add the sender's email address or domain to the Approved Senders list in Settings > approved senders.
Once the sender is added, you will need to find that sender in the Approved list, then hover your mouse over it, and click the edit link.
When the pop-up box opens, check the box for Require SPF sender authentication, and choose an option for when SPF checking fails, then click Update.