What SPF really is
SPF is a TXT record listing every server allowed to send mail for your domain. Receivers check the sending server against it.
Anatomy of a record
A record like v=spf1 include:_spf.google.com ~all means: Google may send, and anything else is soft-failed (~all). Use -all to hard-fail once you're confident.
~all soft-fails unlisted senders (delivered but marked suspicious); -all hard-fails them outright. Move to -all once you're sure every real sender is listed.
The 10-lookup limit
SPF allows only 10 DNS lookups — too many include: entries breaks it silently. Keep it lean and flatten where needed.
Exceed 10 lookups and SPF fails silently — no error, just mail that stops passing.