DKIM and SFP by themselves haven't done a ton, but they both feed into DMARC which absolutely has had an effect. It's probably just not what you think. The poi

DKIM and SFP by themselves haven't done a ton, but they both feed into DMARC which absolutely has had an effect. It's probably just not what you think. The point of DMARC is to protect senders from spoofing. I.e. if I'm PayPal I don't want anyone to be able to spoof email from my domain, so I set a DMARC policy to reject if SFP and DKIM both fail. If I own a domain that I never want to be used for email I can set that same DMARC policy and just neglect to set up SFP and DKIM, therefore ensuring they fail.