Go to WHM
Go to "Exim Configuration"
Go to the "Advanced Editor" tab
Scroll to/locate the section labeled "spf_bl (Reject SPF failures)"
If it is checked, uncheck it (this disabled the default SPF behavior)
Make sure the section just above it labeled "custom_begin_mailauth" is checked (enabled) and paste the below snippet in the text box:
deny
hosts = ! +backupmx_hosts
message = SPF: $sender_host_address is not allowed to send mail from $sender_address_domain
spf = fail