SPF is a TXT record on your domain naming the IPs allowed to send mail as @yourdomain. Receivers check the connecting server against it; mail from elsewhere fails SPF and leans toward spam.
The classic mistake is mail sent by a web script with an envelope sender that does not match the domain’s SPF — instant spam-folder material. SPF works together with DKIM and DMARC; all three need to agree for reliable inbox delivery.
Frequently asked questions
What does “-all” vs “~all” mean in SPF?
-all says “reject everything not listed”; ~all is a softer “mark it suspicious”. Strict -all is right once you are sure the record lists every legitimate sender.
My SPF is correct but mail still goes to spam — why?
SPF alone is not enough: check DKIM signing, DMARC alignment, the envelope sender used by PHP scripts, and whether the server IP sits on a blacklist.