I found the problem: it was my typo in the DNS.
I had added the IP address of the mail server to the SPF record, but I’d preceded it with ipv6: instead of ip6:
So yesterday evening I spent a happy(?) hour or two changing the SPF record for each domain.