Client's DNS is managed by Office 365. Office 365 helpfully creates an SPF record:
TXT @ v=spf1 include:spf.protection.outlook.com -all 1 Hour
Even extra helpfully, this is automatically generated by Office 365 and can't be changed apparently. All I want to do is include Mandrill, but it looks like I'm SOL.
Apart from moving DNS management to another host (which would be painful, but doable), have I got any options?
You have no option but to move the DNS records to another hoster.
Microsoft won't allow you to change the SPF record once it's created at their end.
Read here for more information: https://support.office.com/en-us/article/Add-or-edit-custom-DNS-records-in-Office-365-af00a516-dd39-4eda-af3e-1eaf686c8dc9