SPF PermError
SPF (Sender Policy Framework, RFC 7208) caps how much DNS work a receiver must do to evaluate your policy: the whole recursive evaluation of one SPF record must not require more than 10 mechanisms/modifiers that cause a DNS query.
SPF Softfail (~all)
`~all` is the SoftFail qualifier on the SPF record's final `all` mechanism.
Multiple SPF Records
SPF (Sender Policy Framework) is published as a single DNS TXT record on a domain that begins with "v=spf1".
No DMARC Record
DMARC (Domain-based Message Authentication, Reporting, and Conformance, RFC 7489) is a DNS TXT record published at `_dmarc.
DMARC p=none
DMARC (RFC 7489) is published as a DNS TXT record at _dmarc.
Why DMARC Is Failing
DMARC (RFC 7489) passes only when at least one of SPF or DKIM both authenticates AND is "aligned" with the domain in the visible From header (the RFC5322.
No DKIM Record Found
DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending server attach a cryptographic signature to each outbound message and publish the matching public key in DNS.
No Reverse DNS (PTR / FCrDNS)
Reverse DNS (rDNS) is the PTR record that maps a sending IP address back to a hostname, published in the IP's in-addr.
MTA-STS Not Enforced
MTA-STS (RFC 8461) has two independent halves: a DNS TXT record at `_mta-sts.