The receiving server checks the envelope sender domain (MAIL FROM, also called Return-Path) against the SPF record. Mechanisms such as ip4:, a, mx and include: list the allowed senders; the final -all or ~all says what happens to everyone else.
SPF does not check the visible From header; DMARC ties the two together. Forwarding breaks SPF because the forwarding server is not listed in the original sender's record.
Most common mistakes: more than 10 DNS lookups through nested include: mechanisms (result permerror), two SPF records on the same domain, and forgotten senders such as newsletter tools or the CRM.
Example
v=spf1 mx include:spf.protection.outlook.com -all