Email was designed without any check on who is sending, so anyone can put your domain in the sender field. SPF lets you publish the list of servers that legitimately send for you, such as your mailbox provider and the service that sends your app's sign-up and password reset emails. A receiving server looks the record up and compares it with the server that delivered the message.
The record is a single line that starts with v=spf1, followed by mechanisms such as include: for each sending service, and ends with a rule for everyone else: -all to fail them or ~all to mark them as suspicious. A domain must have only one SPF record, and the standard limits evaluation to ten DNS lookups, so adding a second record or stacking too many include: entries makes the check fail.
SPF on its own is not enough. It checks a technical return address that readers never see, not the From address shown in the inbox, and it breaks when mail is forwarded. It works properly as one part of a set with DKIM and DMARC. For a new app it matters for a practical reason too: without it your transactional emails are more likely to land in spam.
your-domain.com. TXT "v=spf1 include:_spf.google.com include:amazonses.com -all"