Okay, another follow-up - I think there's a problem with the SPF instructions.
Before I had the SPF record in DNS, auto-responses from an OpalStack email going to Gmail had this in the headers:
Received-SPF: neutral (google.com: 184.108.40.206 is neither permitted nor denied by best guess record for domain of <address removed by me>) client-ip=220.127.116.11;
And after following the instructions to add
v=spf1 include:spf.opalstack.com ~all, it is now this:
Received-SPF: softfail (google.com: domain of transitioning <address removed by me> does not designate 18.104.22.168 as permitted sender) client-ip=22.214.171.124;
This seems to be worse! I note that spf.opalstack.com is at 126.96.36.199, rather than 188.8.131.52.