The domain owner publishes a TXT record that begins with v=spf1 and names the permitted senders, such as Microsoft 365, Google Workspace, or a newsletter service. When a message arrives, the receiving server looks up that record and compares it with the server that delivered the message. The ending of the record, such as ~all or -all, says how to treat senders that are not listed.
Without SPF, receiving servers have less reason to trust mail from your domain, and messages are more likely to be filtered as spam. SPF is also one of the two checks that DMARC relies on. For a small business it is usually the first email authentication record to set up, and it must be updated whenever a new tool starts sending email in the company's name.
A domain may have only one SPF record; publishing two makes the check fail. The record is limited to ten DNS lookups, which is easy to exceed after adding several services. SPF checks the hidden return address, not the From address people see, and it often breaks when mail is forwarded, so it is not enough alone. We set up SPF, DKIM, and DMARC together as part of our email deliverability service.