Yes — all three, on every domain that sends email. They're the DNS records that prove your mail is really from you; without them your domain is forgeable, and both Gmail and Microsoft now impose requirements on senders (especially bulk senders) that effectively mandate them.
The division of labor: SPF lists who may send for you, DKIM cryptographically signs each message, DMARC sets the policy for failures and sends you reports. A missing link weakens the other two.
One nuance worth knowing: DMARC set to p=none only monitors — useful for rollout, useless as protection. Once your legitimate senders all pass, move to quarantine or reject. Check all three in seconds with our deliverability tool.