It does, but it’s more involved to setup so depending on how many different sources your domain is using you may not be able to use DKIM everywhere.
Additionally, DKIM keys need to be rotated periodically just like SSL. Many services like Sendgrid or ProtonMail will handle this for you now by setting up multiple CNAME records so they can rotate the keys for you, but it only works with that sender.
SPF helps to address the gaps. I totally agree that strict DMARC policy plus DKIM should be enough though.
Additionally, DKIM keys need to be rotated periodically just like SSL. Many services like Sendgrid or ProtonMail will handle this for you now by setting up multiple CNAME records so they can rotate the keys for you, but it only works with that sender.
SPF helps to address the gaps. I totally agree that strict DMARC policy plus DKIM should be enough though.