There are many posts on this Community, so you should start with a thorough search.
The Marketo docs themselves are somewhat sparse, though there are some supplementary blog posts. Josh also has recommendations here.
From the start you should determine if SPF is necessary at all for your Marketo subscription. Unless you are paying extra for the (non-default) branded sender option, SPF has no relevance. And setting up SPF incorrectly (breaking an existing SPF record in a failed effort to incorporate Marketo, or creating a broken SPF record) will create side effects for your non-marketing email.
In contrast, DKIM is always recommended, and since Marketo expects you to use a Marketo-specific DKIM key and DNS entry, getting it wrong doesn't have side effects (you can make Marketo-generated emails look like spam by messing up DKIM, but you should not worry -- unless you mess up really badly -- about collateral damage to non-Marketo email).
To set up DKIM correctly, you need to have access to, and understanding of, your DNS control panel and access to Marketo admin. It's a two-sided process.
.png)