Check your SPF record the way receivers actually evaluate it

When a receiver evaluates your SPF record it is allowed to make at most 10 DNS lookups, counting every include, redirect, a, mx, and exists mechanism across the entire chain of records you include. Past 10, the receiver is supposed to treat the result as a permanent error, which authenticates nothing. Long include chains from stacking several senders are the usual cause, and the fix is to remove senders you no longer use or flatten the record.

Both are fine in practice. -all (hard fail) tells receivers to reject anything from a server you have not listed; ~all (soft fail) tells them to accept but mark it. ~all is the common, safe default while you are still sure you have listed every legitimate sender. What you must avoid is +all, which authorises everyone, and ?all (neutral), which asserts nothing.

No. SPF on its own does not stop someone spoofing your visible From address, because SPF checks the hidden envelope sender, not the From header a person sees. Stopping visible spoofing needs DMARC, which ties SPF and DKIM to the From domain. SPF is necessary but not sufficient; check your DMARC too.