This looks like a pretty good resource.

I'd like to add the following, which I continually reference and has led to repeatable success:

https://www.linuxbabe.com/mail-server/setting-up-dkim-and-sp...

And as far as confirming it works, I continually rely on sending to a gmail address.

Under the three dots is "view original" which gives you

SPF, DKIM, and DMARC results.

(edit:formatting)

I recently tried bouncing mail during the header phase when DMARC didn't align, but it rejected more legit emails than SPAM. Most of the junk we've been getting passes DMARC and has an unsubscribe link.

I did exactly this today.

Fire up Claude, give it an account with sudo, let it loose. Not long after, emails from $PERSONALDOMAIN are making it through to my gmail and outlook accounts.

You also need to set up reverse dns to avoid ending up in spam folders at the big ones.