Yeah the secure thing is to ignore all requests from domains without DKIM, but that would mean ignoring a lot of legitimate requests which is illegal.

Revolut are known to be a bit shady but in this case they're damned if they do and damned if they don't