What's in it
An SPF record is one TXT record on a domain that starts with v=spf1. The terms after it describe the allowed senders: ip4 and ip6 ranges, a and mx for the addresses of the domain's own hosts and mail servers, and include for an email service's own list. It usually ends with ~all or -all, which sets the result for every server the record didn't list.
A domain should have exactly one. With two TXT records that start with v=spf1, the check stops with a permanent error, so SPF can't pass at all.
How a receiver checks it
The check runs against the envelope sender, the hidden return address that ends up in the Return-Path header, not the From address people see. The receiver fetches that domain's SPF record and reads the terms from left to right. The first one that matches the connecting server's IP address sets the result: pass, fail, softfail or neutral.
Because it only looks at the server, SPF usually fails on forwarded mail, since the forwarding server isn't on the list. It also can't stop someone from putting your domain in the From line. DMARC does that, by tying the result to the From address.
The limit of 10 lookups
Some terms make the receiver look something up in DNS: include, a, mx, ptr, exists and the redirect modifier. RFC 7208 caps a check at 10 of them, counting the ones inside included records, while ip4, ip6 and all are free. Go over and the receiver returns a permanent error, so SPF can't pass for any message.
The count grows quietly. Each email service you add brings an include, and many of those include others. The DNS Lookup follows every include and redirect and shows how many lookups each one uses.