SPF, DKIM and DMARC aren't backups of each other — each solves a question the others don't.
SPF alone answers "who did this come from" at the server level, but usually breaks when mail is forwarded (a mailbox auto-forwarding to another address), because the forwarding server isn't on the original sender's list.
DKIM solves that: because the signature travels with the message itself, it generally survives forwarding intact. But DKIM alone doesn't say what the recipient should do when a signature fails to verify.
DMARC combines the outcome of both and gives the recipient an explicit instruction: something like "reject this if SPF or DKIM fails." Without that instruction, mail that fails both SPF and DKIM can still land in an inbox — it's left to the receiving server's own guess.
With all three: SPF verifies the server, DKIM verifies the content, DMARC says what happens when either fails. Missing one leaves that link of the chain open to forgery.