> SPF attests that the mail was sent by an IP address that is authorized to send for a certain domain. Yes, but SPF ties the IP address only to the Sender addr

> SPF attests that the mail was sent by an IP address that is authorized to send for a certain domain. Yes, but SPF ties the IP address only to the Sender address (MAIL FROM) - so utterly useless in stopping phishing emails for example, if attackers can use said domain in From address. > DKIM attests that various headers, usually including the From: address, are approved by the owner of the domain. As the From address (and implicitly domain) is the one people see (and trust) DKIM in a way should matter more. Also, misconfigured SPF records happen from time to time (on big domains actually), where bad actors can then take advantage of them and abuse delivery, much harder for a DKIM private key to end up in the wrong hands.