Resources
What is an SPF record?
SPF publishes which servers may send mail for your domain. Receivers check the sending address against it.
SPF is a TXT record at the apex, and there may only be one. Two SPF records make the check fail permanently.
Our standard is v=spf1 +a +mx +a:<serverfqdn> -all. The a: mechanism covers both A and AAAA and follows the host if its address changes.
We end with -all, not ~all. A softfail asks receivers to accept mail that failed the check, which is rarely what anyone actually wants.
SPF only checks the envelope sender. It survives no forwarding — that is what DKIM is for.