The easiest and most reliable way to ensure that e-mail originating from Nexternal's servers properly validates with your SPF record is to reference Nexternal's. Thus, you should use the include mechanism in your SPF record:
If, for example, your e-mail is hosted by Google, the recommended SPF record is:
v=spf1 include:_spf.google.com ~all
Adding the recommended mechanism for Nexternal thus gives:
Nexternal recommends that DNS records be created and modified by experienced professionals only. Syntax must be precise.
v=spf1 include:nexternal.com include:_spf.google.com ~all