These three sit right at the heart of email deliverability, and they get thrown around constantly without much explanation. None of them are Zoho features as such, they're internet-wide standards, but getting them right has a direct effect on how your Zoho emails are treated.
Email was never designed with security in mind. On its own, nothing stops someone from sending an email that claims to be from your domain when it isn't. SPF, DKIM, and DMARC exist to close that gap, each tackling a slightly different part of the problem.
SPF is a published list, like a guest list on a door, stating exactly which mail servers are allowed to send email on behalf of your domain. When an email arrives claiming to be from you, the receiving server checks whether it actually came from a server on that list.
DKIM adds a digital signature to outgoing emails, a bit like a wax seal on a letter. The receiving server can check that seal against your domain's public record to confirm the email genuinely came from you and hasn't been tampered with in transit.
DMARC ties SPF and DKIM together and tells receiving servers what to do if an email fails those checks, whether to deliver it anyway, send it to spam, or reject it outright. It can also send you reports showing who is sending email using your domain, which is useful for spotting impersonation attempts.