SPF, Sender Policy Framework, is a DNS TXT record listing which mail servers are authorized to send on behalf of a domain. A receiving server checks the IP address the message actually arrived from against that list.
The address SPF actually authenticates is the envelope sender, RFC5321.MailFrom, a technical address used during the SMTP conversation that almost no one ever sees. It is not the visible From address a reader sees in their inbox. A message can pass SPF cleanly while the visible From address belongs to a completely different domain, which is exactly the gap DMARC's alignment requirement exists to close.
Because only one SPF record may exist per domain, every service sending mail as that domain needs to be merged into the same record rather than each publishing its own, a detail that causes more real-world SPF breakage than the record's actual syntax.