SPF (Sender Policy Framework)
A DNS TXT record that lists which servers may send mail for a domain, so a receiving server can tell a forged sender from a real one.
SPF is a line of text in your domain's DNS that says which servers are allowed to send mail with your domain in the envelope sender. A receiving server reads it, checks the address the mail came from against the list, and marks the message pass, fail or softfail.
A typical record: v=spf1 mx include:_spf.example.com -all. mx allows your own mail servers, include pulls in a provider's list, -all says everything else should fail.
Two things trip people up. The record may trigger at most ten DNS lookups, and every include counts; go over and receivers treat the record as an error. And SPF checks the envelope sender, not the address shown in the mail program, so on its own it does not stop someone forging the visible From line. That is what DMARC adds.
Keep one SPF record per domain, keep it under ten lookups, and end it with -all once every real sender is listed.