What SPF is
SPF is a DNS record that lists which servers are allowed to send mail for your domain. Receiving servers look up the record and compare it with where the message actually came from.
For Microsoft 365 you list Microsoft's mail servers in the SPF record. This is done with include:spf.protection.outlook.com and ends with -all, which says nothing else may send in your name.
What DKIM is and the difference
DKIM signs every message with a cryptographic key. The recipient fetches your public key from DNS and verifies that the message was not altered and that it comes from the right domain.
The difference is simple. SPF checks which server sent the message, while DKIM checks the message itself. SPF can break when mail is forwarded, but the DKIM signature travels with it. That is why you need both.
How to set them up for Microsoft 365
For SPF, add a TXT record at the domain root with the value v=spf1 include:spf.protection.outlook.com -all. If you have other senders, such as a newsletter tool, add their include before -all.
You enable DKIM in the Defender portal under the email settings. You publish the two CNAME records the portal specifies and then turn on signing for the domain. It takes a few minutes before it takes effect.
The 10-lookup limit
SPF may perform at most ten DNS lookups. Every include counts, and an include can in turn contain more. If you pass ten, SPF stops applying and all evaluations become invalid, completely silently.
So keep the number of include lines down. Remove services you no longer use and combine where you can. A check in KOLLEN counts the lookups for you and shows whether you are near the limit.