A record starts with v=spf1. Mechanisms follow: ip4, ip6, a, mx, include, exists, redirect. Evaluation stops at the first match. The all mechanism is the catch-all at the end. Prefixes + (pass), ~ (softfail), - (fail), ? (neutral) change the result. Most people write include:_spf.google.com ~all without the implicit plus.
The ten-lookup budget
Each include, a, mx, exists, and redirect can cause DNS queries. Nested includes count. Cross ten and the result is PermError — often treated like a failure. Marketing teams that stack five ESPs on one domain hit this constantly. Flattening (replacing includes with ip4) helps until an ESP changes addresses. Prefer vendors who publish a single include, and delete the ones you no longer use.
One record, not two
Multiple SPF TXT records on the same name are invalid. Merge them. Do not SPF the website host if it never sends mail; SPF belongs on the domain in the envelope sender, which is often the apex or a bounce subdomain.
SPF is not enough
SPF checks the envelope, not the visible From header. A phisher can pass SPF on their own domain while displaying your brand. DMARC alignment is what ties them together. Read DMARC next. Build a draft with the generator and verify with SPF check.