Where they live
All three are DNS records on your domain: SPF and DMARC as TXT, DKIM usually as TXT or CNAME. You edit them where your nameservers are managed.
Get the exact values
Your email provider (Google Workspace, Microsoft 365, Zoho…) gives you the exact strings. Copy them precisely — a stray space breaks the record.
Copy-paste the values — never retype them. One stray space or character silently breaks the record.
Test before you trust
Use a checker to confirm each record is valid and passing before moving your DMARC policy stricter. (We set this up for a fixed fee if you'd rather not touch DNS.)
Key takeaway
Publish the exact values, verify each one passes, then tighten your DMARC policy.