Why do I keep getting spam with spf-softfail or fail and no dkim verification?

examples:

mx.zohomail.com; spf=softfail (zoho.com: transitioning domain of correo.iberia.es does not designate 198.144.159.159 as permitted sender) smtp.mailfrom=@

mx.zohomail.com; spf=none (zoho.com: 104.243.40.165 is neither permitted nor denied by domain of mail.siju.es) smtp.mailfrom=@

mx.zohomail.com; spf=none (zoho.com: 103.193.137.189 is neither permitted nor denied by domain of roi360u.com.br) smtp.mailfrom=@

These obvious spam messages should be rejected at the smpt server Why are you enabling spammers?