An “include” is an SPF mechanism that points to a domain that needs to be queried when checking if the sending IP is allowed or not. 


If the sending IP is part of the “include” then it results in a match and SPF passes. 


For example if you have “ include:za._netblocks.mimecast.com” as part of your SPF record and the originating IP of an email is a Mimecast IP, it will result in a match as you have authorized google to send on your behalf and the sending IP is found inside of the “include” mechanism.