What it is
SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. Receiving servers look it up to decide whether an incoming message claiming to be from you came from an authorized source.
Why it matters
Without a published SPF record, or with one that ends in a permissive `+all`, anyone can send mail that appears to come from your domain, which is the foundation of phishing and business-email-compromise attacks against your customers and staff. A correct SPF record is also a prerequisite for getting DMARC to pass.
How WebGuard checks it
WebGuard performs a read-only DNS lookup of your domain's SPF record and reports whether it exists and whether its policy is appropriately strict. No mail is sent and nothing is changed.
A sensible starting configuration:
v=spf1 include:_spf.your-provider.com -all