How can you debug SPF failures?

Debug by inspecting:

The IP that attempted delivery.

The envelope from domain.

The applied mechanism.

DNS response.

Any lookup related errors.

This tells you where the chain broke.