SPF error with permerror status

Emails that have “permerror” SPF status as seen on the Email Routing page are being forwarded to the destination without notification. How can I get these to be “dropped”? These emails are attempting to fake an legit user. The SPF dns record is configured to “fail” (-all) but they still get through.