DNS records you publish yourself.

Checklist

Find the provider that sends the mail. Their documentation names the SPF include and the DKIM selector. Add those at the DNS host. Wait for the record to propagate, then send a message to a mailbox you control and read the authentication results in the headers.

Add a DMARC record with a report address. Keep the policy at none until the reports show that your real mail passes. Then consider quarantine. Reject is a later decision.

If you change sending providers, update SPF and DKIM in the same change. Leaving the old include is usually harmless. Removing the new one is not.