Every guide to email authentication starts with a history lesson. Skip it. You are here because your emails land in spam, or a client asked "is DMARC set up?", or you saw dmarc=fail in a bounced message. Here is the 15-minute version: the exact records, why each one exists in one sentence, and how to verify you got it right.
The one-sentence versions
SPF lists which servers may send mail claiming to be from your domain.
DKIM cryptographically signs each message so receivers can verify it was not altered and really came from you.
DMARC tells receivers what to do when SPF or DKIM fail, and sends you reports about it.
