I have SPF and DKIM. I'm planning on adding DMARC to tell receivers to expect SPF and/or DKIM. I've read that it's best to set DMARC up with both SPF and DKIM, but I don't understand exactly when having it for both would be better than having it just for DKIM. Is there some scenario where having DMARC for SPF and DKIM would classify emails better than just having DMARC for DKIM? How common is that scenario?
I don't think there is a simple answer for your question. Both SPF and DKIM are by their own useful in fighting spam but they miss the alignment between the claimed sender in the mail header compared to the SMTP envelope (SPF) or the signature (DKIM). Only DMARC provided this important alignment and adds a policy how do deal with failures on top.
But, by allowing either DKIM or SPF to provide the necessary alignment DMARC it is sufficient to successfully spoof one of these. This means either to successfully misuse an overly broad SPF policy or to make use of the usually shoddy implemented DKIM signatures to change the content of the mail while keeping the signature intact. Thus, by requiring only one of SPF or DKIM to succeed DMARC lets the attacker focus on the weaker problem.
Therefore, one recommendation could be to implement one mechanism properly and strict and don't implement the other one at all and this way taking the choice of the weaker target from the attacker. In this case I would favor to implement DKIM, but implement it properly: sign all relevant mail headers (there are many), oversign all of these to protect against header duplication and also make sure that the signed mail is 7 bit clean. For more on this see Breaking DKIM - on Purpose and by Chance (disclaimer: this is my own research).
The advantage of implementing only DKIM is that one can focus the resources of doing this thing right. Apart from that it provides the stronger protection if properly implemented. But, their is also a big disadvantage of not doing SPF: SPF is far more widely implemented than DKIM or DMARC and thus the chance is only higher that an anti-spam solutions implements only SPF but not DMARC and/or DKIM. While the numbers vary a lot from different sources, in the mails I had access to about 40% were covered by SPF but only about 9% had a DKIM signature and about 6% a DMARC policy.
In summary: the best thing is probably to have both strong DKIM signatures and small and strict SPF policies. Doing this properly is not as simple as it might look like. With a more limited set of resources it might be thus preferred to get one of these right (recommended: DKIM) and skip the other one completely so that an attacker does not have the choice to pick the weaker problem.