Passing DMARC actually comes down to passing SPF or DKIM, preferably both, aligned with your
SPF is checked on the domain used in your return-path address, which is generally set in your SMTP server, before relaying via Google. It might be the same as your
header.from but is not necessarily so.
If you control the domain in the return-path address, you should set up an SPF record that includes Google's SMTP servers. GSuite users need to add
include:_spf.google.com to their record, somewhere after
v=spf1 and before
-all. Be careful though, because adding it will add 4 DNS lookups to your SPF record. Your SPF record would look like this if you only send out emails via Google's SMTP service:
v=spf1 include:_spf.google.com ~all
Remember to edit it when you start using different services.
Additionally you could add DKIM signing on your SMTP server, so messages are signed before routed via Google's SMTP servers. DKIM is checked on the domain in the
header.d header, which should align with your sending domain.
As Tom pointed out, you can add a
rua: tag to your DMARC policy to receive reports on the use and abuse of your domain. You can check a test message's headers to find out the return-path and optionally the DKIM signing information.