Publish your SPF data as TXT records and if your bind supports it add SPF records. All A records which do not support sending mail should have a
v=spf1 -all record.
The SPF site recommends using ip addresses in the form
ip4:192.0.2.0. You only need the address of servers which should be sending email to the network. This may not be your MXs which should be accepting email, and may send email. Only enable sending addresses for domain and sub-domains which send e-mail. If you have roaming users, configure the submission port, and have them send via your mail server. This allows you to end your rule
-all rather than one of looser configurations.
Further details are available from the Sender Policy Framework site. My website has article on setting up mail services using Exim which covers SPF.