What each one does
SPF lists the servers allowed to send for your domain. DKIM signs messages so tampering is detectable. DMARC tells receivers what to do when the first two fail, and asks them to report back.
The order to implement them
SPF first, then DKIM, then DMARC in monitoring mode (p=none) while you read the reports. Only tighten to quarantine or reject once the reports are clean — doing it early blocks your own legitimate mail.
The mistake almost everyone makes
Forgetting a service that sends on your behalf: the invoicing system, the newsletter tool, the CRM. Each needs to be in SPF and ideally signing with DKIM, or its mail fails your own policy.
