In short: An SPF record is a DNS TXT record listing the servers allowed to send email for your domain. Publish exactly one, end it with ~all or -all, and keep it under 10 DNS lookups.
Updated
What an SPF record looks like
A typical record is v=spf1 include:_spf.google.com ~all. It says: Google may send for this domain, and treat everyone else as suspicious.
The ending matters. -all means reject others, ~all means accept but mark as suspicious, ?all means no opinion, and +all allows everyone, which defeats the purpose.
How to set it up
1. List every service that sends email as you: your mail provider, newsletter tool, support desk, invoicing.
2. Find the include value each one tells you to use.
3. Publish one TXT record at your domain root: v=spf1 include:first.example include:second.example ~all.
Mistakes to avoid
Publishing two SPF records. A domain must have exactly one, so merge them.
Going over 10 DNS lookups. Each include counts, and above 10 the whole record fails.
Using +all, which lets anyone send as you.
SPF is not enough alone
SPF checks the hidden envelope sender, not the From address people see. Pair it with DKIM and DMARC for real protection.
Free, no sign-up.
Check your SPF and DMARCCommon questions
Can I have two SPF records?
No. Two records make SPF fail. Combine them into one.
What is the 10 lookup limit?
An SPF check may trigger at most 10 DNS lookups. Records with many include entries can exceed it and then fail.
Where do I add an SPF record?
In the DNS settings of your domain, as a TXT record on the root of the domain.