If your domain sends email, yes. Without DMARC, a forged message claiming to come from your domain arrives looking entirely normal, and the invoice fraud aimed at your customers relies on exactly that.
It is also increasingly not optional. Major providers have tightened requirements for bulk senders, and mail from domains without proper authentication is now rejected outright rather than filtered.
What it actually does
SPF says which servers may send for you. DKIM signs your messages. DMARC is the instruction telling receiving servers what to do when those checks fail: nothing, quarantine, or reject.
The order that matters
Publish it at p=none first. That changes nothing about delivery and starts reports arriving, showing every system sending as you — including the invoicing tool and the booking system you forgot about. Authorise those, confirm they pass, and only then tighten.
Publishing p=reject immediately because a checklist said to is how businesses block their own invoices, and because the rejection happens at the receiving end, you see silence rather than errors.
This is the short version. The full guide covers it properly: read more.
If DKIM is not signing either, start with publishing that first.
The longer version: the DMARC field guide.