Why a correct-looking record stops working — the 10-lookup limit
Each include, a or mx term in an SPF record triggers a DNS lookup. Once the total passes ten, the specification says the record is treated as permanently in error and effectively ignored. Adding a few mail services is enough to cross that line, and because the record still looks fine, it usually goes unnoticed. This check counts the lookups for you.
How the record ends matters
~all means "treat anything else as suspicious"; -all means "reject anything else". Ending with +all lets everyone through, which makes the record pointless. For a domain that never sends mail, the single line v=spf1 -all is the safest setting.
SPF alone is not enough
SPF checks the envelope sender, not the From address the reader actually sees. DMARC is what closes that gap, so the two belong together.