I have set up an SPF record for my domain, but I still can spoof email-addresses for my domain using fake email services like this one: http://deadfake.com/Send.aspx
The email does arrive to my gmail inbox just fine.
The email does have SPF errors in the header like this: spf=fail (google.com: domain of info@mydomain.com does not designate 23.249.225.236 as permitted sender) but it's still received just fine, which means anyone can spoof my email-address…
My SPF record is: v=spf1 mx a ptr include:_spf.google.com -all
UPDATE In case anyone's interested, I have published a DMARC policy along with my SPF record and now Gmail marks spoof messages correctly (picture)
Best Answer
The fact that you advertise an SPF record in no way obliges anyone else to honour it. It is up to the admins of any given mail server what email they choose to accept. I think they're foolish if they don't check SPF records and reject accordingly, but it's up to them. I know some people like DMARC, but I think it's a hideous idea myself, and I won't be reconfiguring my email server to accept/reject based on DMARC; doubtless some people feel the same way about SPF.
What I think SPF does do is allow you to disclaim any further responsibility for email that claimed to be from your domain, but wasn't. Any mail admin coming to you complaining that your domain is sending them spam when they haven't bothered to check the SPF record you advertise that would have told them that the email should be rejected can fairly be sent away with a flea in their ear.