I created an account (as in, I don't use a third party openid provider). I encountered two bugs in this process. First, the confirmation mail was recognized as spam by my provider, with "From SPF protected domain over unauthorized server" as the reason given, which may indicate a configuration error. Then the address in the plain text portion of the mail did not work. The reason is likely that instead of "&" it uses "& amp;" in the link; obviously HTML character references are not recognized in plain text.
The double encoding bug has been fixed.
SPF record is accepted by Google and is well formed so far as I can tell, so no change there.