SPF (Sender Policy Framework)
A DNS record that lists which servers are allowed to send email on behalf of your domain.
SPF (RFC 7208) is a TXT record on your domain that lists the servers allowed to send mail for it, for example v=spf1 include:_spf.google.com ~all. The receiving server checks the connecting IP address against the SPF record of the envelope sender domain (the Return-Path, also called MAIL FROM), not the From address your subscribers see. That difference is why SPF alone does not stop spoofing of your visible From domain, and why DMARC alignment exists.
How to set up SPF
Publish one TXT record that starts with v=spf1 on the domain your platform uses as its envelope sender. Each service that sends for you (newsletter tool, help desk, invoicing app) usually gives you an include: value to add. End the record with ~all (soft fail) or -all (fail). Google and Yahoo both require SPF or DKIM from every sender, and both SPF and DKIM from bulk senders.
Check it by opening a test message in Gmail, choosing Show original and looking for SPF: PASS, or by running your domain through any SPF lookup tool.
Common SPF mistakes
Publishing two SPF records. RFC 7208 allows one per domain; two produce a permanent error, so SPF fails for every message.
Going over 10 DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier each count toward a limit of 10, and lookups inside nested includes count too. Stacking services pushes many domains past the limit, which also produces a permanent error. Remove services you no longer use before adding new includes.
Relying on SPF alone. Forwarded mail arrives from the forwarder's IP and can fail SPF, and SPF never checks the visible From address. DKIM and DMARC cover both gaps.