SPF
SPF lists, in a TXT record, the servers authorized to send mail on behalf of the domain. Recipients check it to reject impersonated senders.
In practice
One record per domain, fewer than ten DNS lookups, and a strict end qualifier — the permissive catch-all is as good as no declaration. Every legitimate sending service is added via its dedicated mechanism; every domain unused for sending deserves a negative SPF that prohibits everything. The oversight shows up in the headers of messages that landed in spam.