The two mechanisms check different things. SPF asks whether the connecting server is allowed to send for the envelope domain, which is a fact about this connection. DKIM asks whether the message arrived as it was signed, which is a fact about the message.
Forwarding is where the difference becomes practical. A message forwarded by a mailing list or an auto-forward rule arrives from the relay's own IP, so SPF fails. The DKIM signature is unaffected and carries DMARC through alone.
Setup is usually a few minutes in your sending platform. Generate a key pair, publish the public key at the selector record the platform names, and switch on signing. Use 2048-bit keys, because the major providers now treat 1024-bit as a weak signature.
Verify it before assuming it works. Send a message to a mailbox you control, read the headers, and look for dkim=pass with your domain in the d= tag. A pass for your platform's domain rather than yours will not align for DMARC.
Rotate the key every six to twelve months. Publish the new selector, wait for DNS to settle, switch signing, and remove the old record once the last signed message has cleared.
What a working setup looks like in DNS and in a header
Say your platform tells you to use the selector s1. You publish a text record at s1._domainkey.yourdomain.com. It starts v=DKIM1; k=rsa; p= and goes on with a long block of letters. That block is your public key. Check that it's live with dig txt s1._domainkey.yourdomain.com.
A 2048-bit key is longer than the 255 characters one DNS string can hold. It has to be entered as two quoted strings, one after the other. Some DNS dashboards split it for you, and others cut it short, which leaves a record that looks fine and fails every check.
Now send yourself a message and open the header. Find the line that starts DKIM-Signature. It should show d=yourdomain.com and s=s1. If d= shows your platform's domain, the mail is signed, but by the wrong party, and DMARC won't count it for you.
Who counts as a bulk sender, and what breaks a signature
Google's line is about 5,000 messages a day to personal Gmail accounts. Above it, you need SPF, DKIM and a DMARC record. Below it, you still need SPF or DKIM, so very few senders are fully exempt.
A signature covers the body and a set of headers. Anything that edits those after signing breaks it. The usual culprits are a mailing list that adds a footer, or a security gateway that rewrites links. An email signature tool that stamps a banner on outgoing mail after your server has signed it will do the same.
If a message fails DKIM only for some recipients, look at what stands between you and them. Order matters inside your own setup too. Whatever adds banners or disclaimers has to run before the signing step. Get the order wrong and every message you send carries a broken signature, and the failure shows up only in DMARC reports.
Related questions
Is DKIM mandatory?
For bulk senders to Gmail and Yahoo, yes, since February 2024. For everyone else it is strongly advisable rather than required.
What key length should I use?
2048-bit. Major providers treat 1024-bit keys as weak rather than valid.
Can I have several DKIM keys?
Yes, one selector per sending platform. That is how multiple senders sign for the same domain independently.
How do I check DKIM is working?
Send to a mailbox you control and read the headers for dkim=pass with your own domain in the d= tag.