That closing rule matters. A record ending in -all asks receivers to fail mail from any server not listed. One ending in ~all asks for a softfail, which the specification calls a weak statement that the server is probably not authorised.
Two rules catch people out. A domain must have only one SPF record: publish a second, often while adding a new email tool, and the check returns a permanent error instead of a result. And a check may make at most 10 DNS lookups, so a record that has collected includes from every service you've ever tried can stop working without anyone touching it. When a new tool asks you to add SPF, merge its include into the record you already have.
SPF checks the sending server, not the message, so mail that passes through a forwarding service can fail it. The specification gives a whole appendix to that problem, which is one reason SPF is normally used alongside DKIM and DMARC rather than on its own.
Updated September 2026
Check it yourself