SPF, DKIM and DMARC records when using Google Workspace

[Corobori]

One of my customer who is using Google Workspace for his email is having some issues with mails not reaching their recipients (and nothing bouncing back with any error I could investigate). According to MXToolbox everything looks fine, including the DKIM record and DMARC

But using Google Admin Toolbox CheckMX results are different:

It says that DKIM and DMARC are not set up, and SPF comes up with an error

Decision: domain owner discourages use of this host
Record: v=spf1 include:_spf.google.com ~all

I tried changing ~all to -all but this gave me and other error
Decision: SPF fail - not authorized
Record: v=spf1 include:_spf.google.com -all

Is there anything I am missing ?

[mabismad]

There’s no PTR, reverse domain lookup record, to match the ip address to the domain. It’s possible that google is starting with the ip address (since that is all it knows about a server sending it an email) and is trying to find the rest of the records by doing a reverse domain lookup, whereas mxtoolbox is starting with the domain name, and can find the records.