An SPF record works by specifying which IP addresses are authorized to send emails on behalf of your domain. When an email is sent, the receiving mail server checks the SPF record of the domain in the email's "From" address. If the sending server's IP address matches one listed in the SPF record, the email is considered legitimate.