DNS Record Explainer

v=spf1 : version tag. Declares this is an SPF record. Receivers ignore anything not starting with exactly "v=spf1".

include:_spf.google.com : tells receivers to evaluate the SPF record of _spf.google.com as if it were inlined here. If that record passes, this mechanism passes. This authorizes Google Workspace / Gmail to send mail for the domain. Note it is a delegation, so Google can change their IP ranges without you editing DNS.

include:mailgun.org : same behavior, authorizes Mailgun's sending infrastructure. Mailgun publishes its authorized senders at its own SPF record, so you inherit whatever they publish.

~all : the catch-all. "~" is softfail: mail from any source not matched above should be treated as suspicious, typically accepted but marked or quarantined depending on the receiver's policy. This is the qualifier applied when no earlier mechanism matched.

• The SPF lookup limit is 10 DNS-querying mechanisms. Each include counts, and each include's own record can add more. Google's and Mailgun's records can each pull in several lookups, so check the total with a tool like dmarcian or mxtoolbox before adding any more includes. Exceeding 10 causes a permerror and SPF fails entirely.
• ~all is a softfail. Many operators now use -all (hardfail) once all legitimate senders are covered, which reduces spoofing. Only switch after confirming every sending service is listed, or legitimate mail will be rejected.
• If you send from any other service (marketing tool, helpdesk, transactional provider, self-hosted server, a "ptr" or bare "a"/"mx" mechanism you forgot about), it is not authorized here and will fail SPF.
• Confirm there is exactly one SPF record at the domain apex. Multiple "v=spf1" TXT records cause a permerror.

SPF authorizes which hosts may send mail using your domain in the envelope sender (MAIL FROM / Return-Path). It matters most when combined with DKIM and a DMARC policy, since DMARC alignment depends on SPF or DKIM passing for the From: domain. Without a correct record, receivers may junk or reject your legitimate mail, and anyone can spoof your domain more easily. Missing or broken SPF is one of the most common causes of deliverability problems for Google Workspace and Mailgun senders.