> Isn’t that already what DMARC does though? For DMARC to pass you need DKIM _or_ SPF alignment, not both.

GP wants require DKIM, so SPF alone is insufficient to send mail from their domains.

If everyone did dmarc, you could set SPF to -all. But there are servers that check SPF but not DMARC. You need to pass SPF for those, so you need a passable SPF... but then DMARC will pass with only SPF.