A record is a TXT entry such as v=spf1 ip4:192.0.2.0/24 include:_spf.example.net mx -all. Mechanisms (ip4, ip6, a, mx, include, exists, ptr, all) are evaluated left to right with qualifiers + (pass, the default), - (fail), ~ (softfail) and ? (neutral); redirect= hands evaluation to another domain. Results are pass, fail, softfail, neutral, none, temperror and permerror.
SPF checks the envelope sender (RFC5321.MailFrom, the bounce address), not the From header the user sees, so on its own it does not stop spoofing of the visible sender; DMARC requires the envelope domain to align with From. Forwarding breaks SPF because the forwarder's IP is not in the original domain's record, unless the forwarder rewrites the envelope (SRS).
Evaluation may trigger at most 10 DNS-querying terms (RFC 7208 §4.6.4), a limit that large include chains of SaaS senders often exceed, producing permerror. A domain should publish exactly one SPF record; two records are also a permerror.