Sender Policy Framework (SPF) is used to authenticate senders of email. Receiving servers use SPF to verify if the message source IP is authorized to send on behalf of the HELO or MAIL FROM domain.

The North Korea-linked hacking group tracked as Kimsuky has been exploiting weak email Domain-based Message Authentication, Reporting and Conformance (DMARC) settings to conceal spear phishing attacks, the US government warns.

Mitigation measures
In these attacks, they exploit missing DMARC policies or DMARC policies with "p=none" configurations, which tell the receiving email server to take no action on messages that fail DMARC checks.

Regrettably, approximately 80% of these entities are susceptible to email spoofing and when I let them know, most of those IT, not all, don't take it seriously.
This vulnerability isn't attributable to a software bugs but rather stems from a lack of expertise and misconfiguration.

DKIM:
* is more resilient/robust
* will survive to more weird email scenarios
* confirm the receiving party that eMails received from your domain were really sent from your domain and that those emails were not altered / tempered with along the way.

* DKIM will be SPF Fail Safe to allow DMARC to work properly