SPF (Sender Policy Framework) is a TXT record in a domain's DNS that lists which servers may send email using that domain:
acme.com. TXT "v=spf1 include:_spf.google.com -all"
Receiving servers use it to spot forged mail.
Why it's a signal for signups
Established businesses that send email publish SPF (and DMARC). A business domain with neither is often brand new, parked, or not used for email at all. Veqen reports it as no_email_authentication, a light signal (impact 8).