I've had a horrible problem with spammers using my domain so I set up DKIM, DMARC and reviewed my SPF record. From DMARC reports I found that a 3rd party service I use was sending email as my domain. So I added the mailserver for the service and its sending IPs to my SPF record and set to disallow all, and I also set DMARC to reject after identifying this.
Now I am finding the 3rd party service IP in the DMARC reports as DKIM fail, that I expected, but also SPF fail, and the mail from the 3rd party is being rejected. I believe my SPF record is set correctly.
Any suggestions on what to look at, what to fix or where to get help if this is too arcane for LET?