SPF publishes a list of IP addresses and hosts authorized to send mail on behalf of a domain, as a DNS TXT record. A receiving mail server checks the connecting IP against that list and can reject or flag mail from anything not listed.
SPF alone only authenticates the envelope sender (the Return-Path), not the visible From address, and it breaks under simple forwarding because the forwarding server's IP is rarely in the original domain's SPF record. That's why SPF is one input into DMARC alignment rather than a deliverability guarantee on its own.
SPF records have a hard limit of 10 DNS lookups; exceeding it causes a permerror and receivers may treat the record as failing entirely. Keep includes flat and audit them whenever a new sending vendor is added.