The three records answer three different questions, and understanding which is which makes the whole thing straightforward.
SPF, who is allowed to send for this domain. A DNS record listing the servers permitted to send mail claiming to be from you. A receiver checks whether the sending server is on the list.
The common mistakes: having two SPF records, which is invalid and fails everything, and exceeding the lookup limit by including too many services.
DKIM, was this message actually sent by them and unmodified. Your sending service signs each message with a private key; the matching public key sits in your DNS. This is the strongest of the three because it survives forwarding.
The common mistake: setting it up for one service and later adding another that signs with a different key that was never published.
DMARC - what should a receiver do when SPF and DKIM disagree with the From address, and where should reports go. This is the one people skip, and it is the one that turns the other two from decoration into policy.
Set all three. Start DMARC in the mode that only reports, read the reports for a couple of weeks to find anything sending as you that you forgot about, then tighten it.
Without DMARC, receivers are guessing. With it, you are telling them.