SPF and DKIM are both measures aimed at alleviating email spoofing - which is a major cause of spam and phishing messages.
SPF works by including a list or range of IPs that legitimate messages from a domain name will be sent from within the domain name's DNS. When a sending mail server connects to a remote mail server, it's connecting IP is identified. If that SMTP message says to be from an @gmail.com email address AND if the connecting sending mail server IP is NOT listed in gmail.com's SPF record, then the message is very likely a spam or phishing message that is trying to spoof an @gmail.com email address.
(Going slightly off-topic for a bit, but in my opinion, this is why ?all and ~all directives in an SPF record are useless. These operators are saying: "these are probably the only IP addresses that should be sending legitimate mail from this domain." What? You mean you don't know what IP addresses are going to be responsible for sending legitimate mail from your domain name? Figure out what IP addresses are going to be sending out mail from your IP address and set up your SPF record properly and use -all.)
DKIM is similar to SPF but different. DKIM is a utilization of a public/private encryption key pair. The private key is held in secret on the sending server and the public key is added to the domain's DNS record. Using certain defined headers in the message, the sending server will encrypt and create a signature of those headers using the private key. When a receiving server gets the message the DKIM header will tell the receiving server what domain name to look up the public key on, as well as a selector. Selectors allow different messages to be signed with different keys - this tends to have more meaning in larger corporations where billing, sales, marketing, support, etc may be more divided. The receiving server will take this information, as well as the list of headers and compare the included encryption signature with the receiving server's calculation of those headers against the public key encryption signature. If they match, then the message was sent from a server that had the DKIM private key, so it's probably legit.
So if a receiving server gets a message that matches a sending IP address defined in the domain's SPF record AND it's properly signed by a DKIM key, then by all accounts, that message is probably legit.
Now... that still doesn't mean the message isn't spam. People tend to use very weak and stupid passwords for their email accounts, so if a spammer or hacker is able to retrieve that information and send out their spam message through the server hosting that domain... then you're going to get spam that verifies against SPF and verifies against DKIM.
BUT... theoretically, no mail server is going to be able to duplicate IP matching SPF and DKIM matching keys for major email service providers - like Gmail, Microsoft, Yahoo, etc. So while someone on your server can still send a message pretending to be from @gmail.com or @hotmail.com - those messages aren't going to very against SPF and DKIM. Still can get your server blacklisted though, because receiving servers are going to see your server attempting to spoof email addresses.
