SPF
An SPF record lists which mail servers are allowed to send mail for a domain, so a receiving server can check whether the sending server is authorised to use that domain. It's not a separate record type of its own, it's a TXT record, sitting at the domain's own apex.
| Name | Type | Value |
|---|---|---|
| (apex) | TXT | "v=spf1 include:_spf.google.com -all" |
-all: the part that actually protects you
Everything else in an SPF record builds up to one final instruction: what to do with a server that isn't on the list. -all says that anything not explicitly allowed is not authorised to send for the domain. What the receiving server does with that result is its own policy, plenty reject the message or treat it as suspect, but the record itself only states who is authorised. Leave that part off, or soften it, and the record stops meaning very much, it becomes a list of who's expected to send mail without actually ruling anyone else out.
Worth publishing even where you never send mail
A domain, or a subdomain, that never sends mail at all is still a usable target to spoof from, precisely because nobody's watching for mail that was never supposed to exist in the first place. Publishing v=spf1 -all there, an empty list plus a hard fail, tells receiving servers plainly that nothing is authorised to send mail for it, at no cost, since there's nothing to allow in the first place and nothing to remember to update later.
What SPF doesn't check
SPF only checks the technical sending server, not the "From" address a person actually sees on the message itself, and ordinary forwarding often breaks it, because the forwarding server becomes the technical sender. That's part of why SPF is normally deployed alongside DKIM and DMARC, rather than relied on by itself.
Building one yourself
Assembling an SPF record correctly by hand, especially once more than one sending service is involved, is easy to get subtly wrong. Expert Tools' SPF wizard builds one for you: tick the services you actually use, and it assembles the record for you to review and publish. Two of its fields, for exists: macros and redirect=, are advanced mechanisms almost nobody actually needs, safe to leave blank unless you already know you specifically need one of them.