SPF
Add include:_spf.google.com to your existing SPF record. Do not create a second record: two SPF records mean neither works, and that is the most common mistake in this whole area.
A complete record with Google Workspace alone looks like v=spf1 include:_spf.google.com ~all. If you use other sending tools, their includes go in the same record.
DKIM
Found in Admin console, then Apps, then Google Workspace, then Gmail, then Authenticate email.
Google generates a 2048-bit key and gives you a single TXT record. Generate the key, publish the record, then return and press Start Authentication. Missing that last step is the most common mistake: the record exists and signing is never switched on.
Google Workspace publishes keys under the selector google (and google2, google3 if you rotate), which is what an external check looks for.
DMARC
DMARC is the same regardless of provider, because it is your instruction rather than theirs. Start at v=DMARC1; p=none; rua=mailto:you@yourdomain.com, read the reports for a few weeks, authorise everything legitimate, and only then tighten. The DMARC guide covers the order in detail, and the order is what stops you blocking your own invoices.
Worth knowing with Google Workspace
Google Workspace is the most common provider we see, and the most common SPF mistake alongside it is keeping an old include from a previous host. If you migrated from a hosting provider's mail, remove their include rather than leaving it in place.
Check it afterwards
Publishing the records is not the same as them working. Verify from outside: whether SPF passes, whether a DKIM signature is actually present, and how many lookups your SPF now performs. The free mail check answers all three in plain language.
More on SPF itself: the SPF field guide.