An SPF record starts with v=spf1 followed by mechanisms: ip4 and ip6 for address ranges, a and mx for the domain's own hosts, and include to pull in the list of a provider that sends mail for you. It ends with a catch-all: -all (reject everything else), ~all (soft fail: accept but treat with suspicion) or ?all (no statement).
The receiving server checks the connecting IP address against the SPF record of the envelope sender domain (the Return-Path), not the From address the user sees. That gap is what DMARC closes, by requiring that the SPF domain aligns with the visible From domain.
Two limits cause most SPF failures. A domain may publish only one v=spf1 record; two records produce a permanent error. And evaluation may trigger at most ten DNS lookups, counting include, a, mx, exists and redirect, including nested ones; exceeding it is also a permanent error. SPF also breaks when mail is forwarded, because the forwarder's IP is not in your record, which is one reason to sign mail with DKIM as well.
Example
example.com. 3600 IN TXT "v=spf1 ip4:192.0.2.0/24 include:_spf.mailer.example -all"