I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered that the problem with using just SPF is that automatic forwarding will break (at least if we check alignment with the From header).
But why can't we use just DKIM? Especially since apparently DMARC succeeds if either SPF or DKIM succeeds. Is there any added value to also deploying SPF?
This answer mentions replay prevention. Is this a valid reason? And still: what about automatic forwarding?