In more detail
SPF (Sender Policy Framework) is a DNS TXT record in which a domain lists the servers allowed to send its email. Receivers compare the connecting server's IP address with the list in the envelope sender's domain and treat mail from other sources according to the ending (-all fail, ~all soft fail). A record may cause at most 10 DNS lookups, and a domain must have only one. SPF alone does not protect the visible From address: that takes DMARC. It also breaks on forwarding, because the forwarder's IP is not on the original list.
Why it matters
A missing or wrong SPF record sends legitimate mail to spam, and a record with more than 10 lookups causes a permanent error that many receivers treat as a failure. An overly loose ending such as +all authorises the whole internet. SPF works together with DKIM and DMARC, and it is just one of the checks behind deliverability. See How Email Authentication Works: SPF, DKIM and DMARC.
Example
v=spf1 ip4:192.0.2.0/24 include:_spf.example.net mx -all
A message from 192.0.2.77 matches the ip4 range and passes. One from 203.0.113.9 matches nothing and reaches -all, so it fails. Here include and mx each cost one DNS lookup (plus any inside the include), while ip4 and all cost none. Build a record with the SPF Record Generator and verify it with the Email Deliverability Checker.
Common confusion
SPF checks the hidden envelope sender and server IP, not the From address the recipient sees. DKIM signs the message itself, and DMARC ties both to the visible domain. Related: MX record.