The risk
Without these records, anyone can send email that looks like it's from your business: fake invoices, payment changes or password resets sent to your customers.
SPF and DKIM
SPF is a DNS record listing which services may send email for your domain. DKIM adds a signature to each message; your email provider gives you the record to add.
DMARC
DMARC tells receiving servers what to do with mail that fails SPF and DKIM and sends you reports. Start with p=none to watch, then move to quarantine and reject once your real email passes.
Do this today
List every service that sends email for your business (email provider, newsletter, invoicing, website forms).