What an SPF record is
SPF (Sender Policy Framework) is a single DNS TXT record, at your root domain, that lists the servers allowed to send email for you. It begins with v=spf1 and ends with an all mechanism.
Mechanisms include ip4: and ip6: for specific addresses, a and mx to authorize your own hosts, and include: to delegate to a provider's SPF (for example your mailbox or marketing platform).
v=spf1 include:_spf.google.com include:sendgrid.net ~allThe one-record rule
A domain must have exactly one v=spf1 record. Two or more is an RFC violation that produces a permerror, and many receivers then fail the check. If you use several providers, merge their include: statements into a single record.
The 10-lookup limit
SPF evaluation may perform at most 10 DNS lookups. Every include, a, mx, ptr and exists mechanism counts, and nested includes count too — a single provider include can consume several.
Exceed 10 and evaluation returns a permerror, which fails authentication. If you are near the limit, reduce providers or use SPF flattening, which replaces includes with their resolved IP ranges.
Ending your record
The all mechanism decides what happens to senders not on the list. -all is a hard fail (reject them), ~all is a soft fail (accept but mark), ?all is neutral, and +all authorizes everyone — never use it.
Once you are confident your record lists every legitimate sender, -all is the strongest choice. A domain that never sends mail should publish v=spf1 -all to declare exactly that.