The Google Workspace SPF record is a single TXT record: v=spf1 include:_spf.google.com ~all. It is published at your domain's DNS host, the same place MX and DKIM records live, not inside the Google Admin console.
The ~all at the end is a soft fail: receiving servers accept mail from senders not listed in the record but treat it as suspicious, rather than rejecting it outright the way a hard fail (-all) would. This is Google's own standard recommendation for the record.
Only one SPF record may exist per domain. Every other service that sends mail as the domain, a CRM, a helpdesk tool, a marketing platform, needs its include: mechanism added inside this same record rather than published as a second TXT record.
The six-gate order I run on every problem puts authentication first for exactly this reason: it is cheap and fast to rule out, so there is no reason to spend an afternoon reading reputation data before confirming the DNS side is actually clean.
At your DNS host, not in the Google Admin console. Google Workspace does not manage your domain's DNS records directly unless your domain is also registered through Google Domains.
A soft fail. Receiving servers are told to accept messages from senders not listed in the record but flag them as suspicious, rather than rejecting them outright the way a hard fail (-all) would.
Yes. Any other service sending mail as your domain needs its own include mechanism inside this same SPF record, since only one may exist per domain.