SPF is published as a single DNS TXT record listing the IP addresses and hosts allowed to send for your domain — usually via `include:` mechanisms for each email provider you use, ending in `~all` (softfail) or `-all` (hardfail). Receiving servers check the connecting IP against this record and feed the pass/fail result into spam filtering and DMARC.
The key limitation is that SPF validates the hidden envelope sender (the Return-Path), not the visible From header a recipient sees — so on its own it does not stop display-name spoofing. It also breaks on forwarding, because the forwarding server's IP is not in your record, and it has a hard limit of 10 DNS lookups; exceeding that produces a permerror that can quietly hurt deliverability.
Practically: keep one SPF record per domain, add an `include:` for every service that sends as you (your ESP, CRM, help desk, invoicing), flatten lookups if you approach the limit of 10, and never publish two SPF records on one domain. SPF is necessary but not sufficient — pair it with DKIM and DMARC.