How does an SPF record work, and what is the difference between ~all and -all?

SPF (Sender Policy Framework) is a DNS TXT record on the sending domain that lists the IP addresses and mail servers authorised to send email on behalf of that domain. Receiving servers look up the sending domain's SPF record and verify that the sending IP is listed.
include mechanism: Delegates to another domain's SPF record. Marketing Cloud SAP requires adding include:cust-spf.exacttarget.com to your SPF record.
~all (softfail): IPs not listed should be treated with suspicion but still accepted. Most MBPs accept softfail mail but may apply a spam score penalty. Recommended for initial SPF rollout.
-all (hardfail): IPs not listed should be rejected outright. Use -all once you are confident all legitimate sending sources are enumerated. SPF lookup limit is 10 DNS lookups — exceeding this causes a PermError.