Th easiest and most reliable way to ensure that e-mail originating from Nexternal's servers properly validates with your SPF record is to reference Nexternal's. Thus, you should use the include mechanism in your SPF record:
If, for example, your e-mail is hosted by Google, the recommended SPF record is:
v=spf1 include:_spf.google.com ~all
Adding the recommended mechanism for Nexternal thus gives:
v=spf1 include:_spf.google.com include:nexternal.com ~all
For more information on the SPF record syntax, please see this page. Nexternal recommends that DNS records be created and modified by experienced professionals only.