اختبار شهادة محلل الأمن السيبراني CompTIA CySA+

Question: A company migrated its email solution from hybrid to on premises only. The administrator made the following changes:

Hybrid, before the migration:

v=spf1 include:cloud.mailprovider.com ip4:200.100.50.25/32 -all

On premises, after the migration:

v=spf1 ip4:200.100.50.25/32 -all

A few weeks after the migration, multiple clients report that the company's emails are being marked as spam. The systems administrator notices that the SPF record has been manipulated by a threat actor who is spoofing the company's domain. The unauthorized change:

v=spf1 include:cloud.mailprovider.com ip4:100.50.25.10 ~all

Which of the following explains the reason legitimate emails are being marked as spam?