How SPF, DKIM and DMARC work together
SPF authorizes the envelope sender; DKIM signs content; DMARC checks whether one identity aligns with visible From.
Attack scenario
An attacker can use From: ceo@example.com. If SPF fails and no DKIM signature aligns, DMARC p=reject asks a compliant receiver to reject it.
Legitimate provider
A legitimate provider can pass aligned SPF or DKIM. DMARC then passes even if the other mechanism does not.
Use all three
SPF and DKIM give independent signals. DMARC turns aligned results into policy for the visible domain.