How SPF works in plain English
Publish one SPF TXT record at the domain used by your envelope sender. Receivers evaluate the connecting IP against its mechanisms. A passing SPF result contributes to DMARC only when the authenticated domain aligns with the visible From domain.
Why SPF matters
SPF helps receivers evaluate whether an IP is authorised for the envelope-sender domain. Use it with aligned DKIM and DMARC to protect the visible From identity.
What does an SPF record look like?
An example is v=spf1 include:spf.senddio.com ~all. Merge the include required by your setup into your existing SPF record rather than publishing a second SPF record. A trailing -all produces an SPF fail for unmatched senders; it does not itself mandate rejection.
SPF lookup limit
SPF limits DNS-querying terms, including nested includes, to ten during evaluation. Check the complete include chain for every provider; a single include is not a guarantee that you remain below the limit.