How to fix SPF issue - email

Question

So I'm using mail-tester.com, which is great, except now I'm royally confused. The first time I ran a test, here's what it said (in the SPF section, where the problem is that: You are not allowed to use one of your sender email addresses)
What we retained as your current SPF record is:
v=spf1 a mx ~all
It should be changed to:
v=spf1 a mx ip4:some-ip-address ~all
Need guidance? Visit the guide for cloudflare.
When I clicked the link to the guide for CloudFlare, it literally said my new TXT record should be v=spf1 a mx ~all, which basically contradicted the previous page. So... perhaps the initial diagnostics page was specific guidance while the guide for CloudFlare was just general guidance, on where to put the record? Anyway, so I didn't have a TXT record with v=spf1 a mx ~all in CloudFlare (unusual again given the previous page said it had retained a SPF record as such), so I added it. It didn't do anything to fix my score.
So what I thought then was, OK let's follow the diagnostic's page's specific guidance and add the IP address. The next time I ran a test, I got:
What we retained as your current SPF record is:
v=spf1 a mx ip4:some-ip-address ~all
It should be changed to:
v=spf1 a mx ip4:some-ip-address ip4:different-ip-address ~all
Need guidance? Visit the guide for cloudflare.
And... you guessed it, following these instructions continually just gets me to a never ending cycle of new ip addresses being added to the record, but nothing actually changing my score. Like, now I'm at:
What we retained as your current SPF record is:
v=spf1 a mx ip4:some-ip-address ip4:different-ip-address ~all
It should be changed to:
v=spf1 a mx ip4:some-ip-address ip4:different-ip-address ip4:another-ip-address ~all
Need guidance? Visit the guide for cloudflare.
Has anyone else had experience with this? If you can't tell, I'm a total noob to SPF and have no idea how to fix this honestly. For context, My domain and mail are managed by Gandi, but redirected through CloudFlare, so CloudFlare is where my DNS records are actually kept.

Answer 1

When you say this:
v=spf1 a mx ~all
It says that the IP that resolves from your domain's A record, and any of the IPs designated as mail exchangers for your domain will receive an SPF pass status, and everything else will receive a softfail.
So, when you're getting that error, it means you're sending from somewhere that is not covered by that list of permitted sources, and so it's suggesting you add the sending IP to your record to allow it.
If you are sending from somewhere like gmail with a large pool of mail servers, the source address will change frequently, which would explain why it suggests a different IP each time.
There are two solutions to this:
Don't send using the external service and really send only from the IPs that you designate explicitly (i.e. that are covered by your a and mx options).
Use an SPF include directive to allow sending from a source that uses dynamic sending IPs.
In this latter case you would make your record something like:
v=spf1 a mx include:_spf.google.com ~all
While you say you're using cloudflare and gandi, you don't say where you're actually sending email from - if you're not using gmail then include the SPF from whichever other service you are using.
Update. Given an actual source IP of 217.70.183.200, we can see what's happening. Whois tells us that that IP belongs to gandi.net, and a lookup for gandi.net's SPF record returns this:
v=spf1 ip4:217.70.176.0/21 ip4:217.70.186.186/32 ip4:217.70.186.187/32 ip6:2001:4b98:c::/48 ip6:2001:4b98:dc2:43:216:3eff:fe69:f13/128 ip4:217.70.186.186/32 ip6:2001:4b98:dc2:90:217:70:186:186/128 ptr ?all
The first address range listed in there (ip4:217.70.176.0/21) covers the 217.70.183.200 address, so I suggest you set your SPF to this, which should solve your problem (and is exactly what I said in option 2 above):
v=spf1 a mx include:gandi.net include:_spf.google.com ~all