FINAL EDIT : I was completely wrong about DKIM it seems, the signing domain does not have to be the same as the sender domain, thus the whole premise for my question is flawed. A lot of thanks to Paul for pointing out my mistake!
Original Question below:
I have tried reading up on both SPF and DKIM, but I do not understand the point of using both at the same time, at least in the context of fighting spam (forged sender addresses, which can result in my email server/domain becoming blacklisted). As far as I can understand DKIM alone should do the job the SPF is supposed to do.
My understanding so far is the following:
- When sending an email the sender can claim anything they want (e.g. fake sender address)
- DKIM allows to detect a fake sender email address, because you can verify the DKIM signature against the public key in the DNS TXT record.
- SPF allows you to verify that the email was sent from a mail server that is authorized to send emails for a given sender address.
The thing that I do not understand is this: Unless the DKIM private key has become compromised in some way, the DKIM verification alone should be sufficient to verify that the email was sent from an authorized email server, because otherwise the email server would not have the private key to sign the email.
I have seen the answer to a very similar question here: https://serverfault.com/a/780248/154775, in it the author claims that DKIM cannot prevent replay attacks. I will concede that point, but I find that to be very much a corner case, the by far biggest issue in my opinion is spam with fake sender addresses - DKIM should prevent that easily on its own.
Is there a scenario beyond replay attacks where SPF provides additional protection compared to only DKIM?
EDIT : I have marked the core of my question in bold to clarify what exactly I want an answer to.