When we run a security assessment, one of the first things we check is whether an outsider can send email that appears to come from the client's own domain. Alarmingly often, they can.
This matters because the most effective attacks are not technically sophisticated. They are an email that looks like it came from the finance director, asking for a payment to be redirected. If your domain has no email authentication configured, nothing stops anyone in the world from sending that message.
The three records
SPF lists which servers may send mail on behalf of your domain. It is a single DNS record and takes minutes to publish.
DKIM attaches a cryptographic signature to outgoing mail, letting the receiving server confirm the message was not altered in transit and genuinely came from your infrastructure.
DMARC ties the two together, tells receiving servers what to do when a message fails, and sends you reports on who is attempting to send as you.
Rolling it out without breaking your mail
Publish SPF and DKIM first. Then publish DMARC in monitoring mode, which changes nothing but starts the reports flowing. Read those reports for a few weeks to find the legitimate systems you had forgotten about: the accounting package, the CRM, the mailing list tool. Add them. Only once the reports are clean should you move to a policy that rejects failures.
The whole exercise is an afternoon of work plus a few weeks of patience, and it closes one of the most heavily used doors in the building.