In addition to the answer from @glts, I would like to add that nowadays, we should look at SPF policy in the light of DMARC developments. ALthough, we can't assume too much about what email service providers are using for determining SPAM likelihood, in terms of email authentication, DMARC has (should have) a much stronger impact on the classification of messages than SPF.
?all is a catch all option, which tells receiving servers how to handle messages that do not pass any previously listed mechanisms. In respect to DMARC, only PASS results matter, in alignment with the domain used in the FROM header.
In practice, I usually advise against using the FAIL ('-') qualifier with the all mechanism. The FAIL qualifier often triggers a definite Junk deliverey, where a Soft Fail ('~') or Neutral ('?') qualifier may not. Especially in cases where your emails are forwarded, SPF tends to break. In this scenario, especially in combination with DKIM signing, your emails have a much better chance of being delivered to the Inbox.
Regarding your question on FCrDNS:
It will help to have your HELO response (mostly the hostname) match the DNS name that resolves to the connecting IP. And have the reverse lookup of the IP confirm that hostname. But that does not mean that this hostname is in the same DNS Zone as the sender address domain. Nor does it have to be, for example when you use a SaaS platform to send marketing emails on your behalf.
