Having SPF records on a domain does not prevent the receiving of spam it simply helps servers make decisions. There is no way to prevent spoofing through DKIM, Domain Key or SPF records.
The reason you received that email is a few possibilities but not limited too:
- A non-blacklisted IP sender
- Unique content within the email
Google, Hotmail, cPanel, Yahoo, Aol and all the other email providers use anti-spam but they are setup to 'learn' what spam is and what is not. By default most will accept spoofed email, this is because often websites will send emails without these additional domain records, it only becomes an issue when:
- Emails sent to contain the same or similar content to multiple recipients.
- If too many emails are being sent within a given time period.
- Content that looks spammy.
- If the end user flags the email as spam.
So while you may have received it, if they tried the same stuff on a larger scale, they would be quickly marked as spam. To prevent such emails, mark the email as spam within the Gmail dashboard, that will tell their email servers to do further checks for other users.
It could also be possible that you have received emails in the past from this domain so therefore Google does less checks. Spoof emailed always appeared as 'Send by X on behalf of Y' and there is no way to prevent it 100%, its a phished and it's not your responsibility to worry about it.