SPF failure with record with include:%{i}

The "include" adds to the SPF record some other records defined externally, in your case "manulife.com._nspf.vali.email".

$ dig +short txt manulife.com._nspf.vali.email 
"v=spf1 -all"

The -all is recommended and means: don't accept any mail from other than the sources defined in SPF record.

While the ~all (soft fail) is not recommended, I think it was used in ancient world by mail providers that may have dynamic MTAs. This one means: it's up to you to accept mails from other than the sources defined in SPF record. This is not good, and you should not use it, and also you should configure your FML to quarantine these mails.

But this is the first time I meet SPF macros. And I found this:

• %{s}: The “s” Macro represents the sender’s email address. Example- Mark@domain.com.
• %{l}: It’s used to denote the local part of the sender. Example- Mark.
• %{o}: This highlights the sender’s domain. Example: domain.com.
• %{d}: Similar to “o”, this Macro represents the authoritative sending domain. In most cases it is the same as the sender’s domain however, it may differ in some cases.
• %{i}: It’s used to extract the IP address of the sender of the message, e.g. 192.168.1.100
• %{h}: The hostname specified by the HELO or EHLO command used during the SMTP connection when the message is being sent is referred to by the %{h} macro.

Ref: https://powerdmarc.com/spf-macros-everything-you-need-to-know/