Well, I've figured it out. App Engine sends the mail via
*.
apphosting.bounces.google.com, so SPF checks against that domain
(and not the app domain). So to answer my question: no, because SPF is
already set by Google. However, when sending from Google Apps, SPF
needs to be set in the DNS settings.