SPF and DKIM don't work together to prevent spoofing. They both only provide information which then can be used in DMARC to prevent (some kind of) sender spoofing.
Notably SPF provides the information if the claimed SMTP envelope sender is allowed to send from the specific IP address based on a policy stored by the domain owner in the DNS. DKIM instead provides cryptographically protected information if the mail was delivered over the mail server responsible for a specific domain.
If either SPF or DKIM are successful and if the domain from these can be aligned with the domain given the the mail envelope From (which can be different from SMTP envelope), then one can be mostly sure that the mail comes from the specific domain.
Note that this does not check a specific sender, only the domain. It thus does not by itself prevent spoofing of one mail account in a specific domain from another in the same domain - one can only hope (but not verify) that this is handled inside the domain already.
And there are also various other kinds of spoofing or how existing techniques can be bypassed - see Weak Links in Authentication Chains: A Large-scale
Analysis of Email Sender Spoofing Attacks from Usenix Security 2021.