SPF works by comparing the IP address of the message with a list of approved IP addresses associated with the domain from which it was sent. If the message is coming from an IP address that is not on that list, SPF will reject it and mark it as spam or suspicious.