Can SPF or DKIM alone stop spoofing?

SPF alone doesn't stop spoofing because it checks the envelope sender, not the header From that recipients see. Attackers can pass SPF with their own domain while spoofing the visible From header.

DKIM alone doesn't stop spoofing because it signs a specific sender identity but doesn't instruct receivers what to do when messages fail. Without policy enforcement, failed DKIM doesn't prevent delivery.

DMARC combines both and adds enforcement. It requires SPF or DKIM to align with the header From domain and tells receivers to reject misaligned messages. Only DMARC with enforcement effectively prevents domain spoofing.