Green

In general to "make everything green":

DMARC: you need to have a correct DMARC record for the domain. See the "Add DMARC" section in the application for suggestions on a correct record, or use the record creation tool.

SPF: you need to have a correct SPF record. Based on DMARC feedback indicating who your vendors are and how well/poorly they authenticate, you must work with those vendors to obtain guidance on how to update your SPF record to allow messages they send to authenticate.  The Detail Viewer allows you to see which sender traffic needs attention, and the 'Source Capabilities' in the Detail Viewer often has suggestions on your next steps.

DKIM: you cannot always make this turn green: this will be green if there is aligned DKIM-signed traffic reported in DMARC reports. In some cases for active domains this will not happen (such as if the sole sender source for the domain cannot/does not sign DKIM for your domain). For inactive domains, there is no DKIM signing, so it will not be green. In cases for most active domains you need to work with your vendors to set up correct DKIM signing. The Detail Viewer guidance can show which sources need work.

To note, a green DKIM indicator does not indicate that all is well with DKIM signing, it simply means that there is *some*. You must check the Detail Viewer for more information.