SPF records explained
SPF is a TXT record on your domain listing which servers may send mail for it. A receiver looks up the record, compares it with the address the message came from and gets a pass or a fail.
example.com. TXT "v=spf1 include:spf.messagingengine.com -all"Publish exactly one
Two SPF records is a permanent error. Receivers are not required to pick one, so in practice SPF stops working entirely for your domain. This happens when a new service asks you to "add this TXT record" and you add a second one instead of merging its include into the record you already have.
How it should end
The last mechanism decides what happens to everyone not listed. -all means reject, ~all means accept but mark it, and ?all means nothing at all. Start on ~all while you are still discovering which services send as your domain, then move to -all once the list is complete and DMARC reports are quiet.
Never publish +all
It authorises the entire internet to send mail as your domain, which is actively worse than publishing nothing. It usually appears by accident, copied from an example, so it is worth checking even if you think you would never do it.
Things to avoid
Skip the ptr mechanism, it is deprecated, slow, and some receivers ignore it. Keep an eye on the length too: a single TXT string cannot exceed 255 characters, and while longer records can be split into chunks, needing to is a sign the record has grown too far.
SPF only proves the envelope sender, not the From: header a person actually sees, which is exactly the gap DMARC exists to close. Check yours with Mail Check.