Its not "one header" to fix. SPF and DKIM must be implemented.

If you have no spf or dkim your emails have been getting rejected for a very long time.

(dmarc only requires one of spf or dkim, not both, but it is a good idea to use both)