Can SPF and DKIM replace each other?

Short answer: no, they can't replace each other. They don't do the same thing, and they don't fail in the same way. You actually need both.

SPF tells receiving mail servers which IP addresses are allowed to send email on behalf of your domain. Think of it as a guest list checked at the door. If the sending IP isn't on the list, SPF fails.

DKIM works differently. It attaches a cryptographic signature to each email, and the receiving server checks that signature against a public key in your DNS. It's not checking who sent it. It's checking that the message wasn't tampered with in transit.

Here's where the practical difference really shows up. When an email gets forwarded, the IP address changes. The new forwarding server isn't on your SPF record, so SPF breaks. DKIM survives that hop, because the signature travels with the message itself. Flip it around though: if a forwarding server or mailing list rewrites the email body or adds a footer, DKIM can break, because the content no longer matches the original signature. SPF isn't affected by content changes at all.

That's why you want both. They cover each other's weak spots. When one fails, the other often still passes.

This matters a lot for DMARC, which requires at least one of them to align (meaning the domain in the signature or the return-path matches your From domain). If you're only running SPF and your email gets forwarded, DMARC has nothing to hold onto. Add DKIM, and DMARC still passes even when the forwarded IP doesn't match.

So if someone on your team asks "can we just skip DKIM since SPF is already set up" (it comes up more than you'd think), the honest answer is: SPF alone is fragile. It breaks on forwarding, and it gives you nothing to fall back on when DMARC checks run. Set up both, and you're covered across far more routing scenarios.

Not sure if your DKIM is actually configured and signing correctly? You can check it with our free DKIM Record Lookup tool. Takes about ten seconds.