How do I set up DMARC after SPF and DKIM are passing?

Smart to be cautious — the safe approach is to start in monitoring-only mode. Add a TXT record at _dmarc.yourdomain.com with:

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

With p=none, nothing gets blocked or quarantined — you just start receiving daily aggregate reports showing what's passing/failing across all mail claiming to be from your domain. After a couple weeks of clean reports with no unexpected failures, you can tighten it to p=quarantine, and eventually p=reject once you're fully confident.

All email claiming to be from your domain, regardless of what sent it — DMARC is domain-wide, not tool-specific. So if you also send from a personal alias, an invoicing tool, a helpdesk system, etc., all of those need to be passing SPF or DKIM (with alignment) too, or they'll get rejected once you're at p=reject. That's exactly why the monitoring period matters — the aggregate reports will show you every source sending as your domain, including ones you might have forgotten about.