DKIM and SPF are supposed to prevent email sender spoofing, but that requires the domain owner to set it up correctly age the receiver to verify the records and actually distrust or discard the email if they don't match.

Both steps aren't trivial, and configuration errors are more common than actual spoofing. DMARC is supposed to fix everything, but only if the domain owner cares enough to do more than the bare minimum setup