SPF — the guest list
SPF lists which servers are allowed to send email for your domain, so receivers can spot impostors.
DKIM — the tamper-proof seal
DKIM adds a cryptographic signature to each message, proving it wasn't altered and really came from your domain.
It signs the message with a private key; the receiver checks the signature against your public key. If anything changed in transit, the signature fails.
DMARC — the bouncer's instructions
DMARC ties SPF and DKIM together and tells receivers what to do with fakes (none, quarantine, or reject) — plus sends you reports.
Key takeaway
SPF says who can send, DKIM proves it's untampered, DMARC decides what happens to fakes.