DKIM

DKIM adds a cryptographic signature to outgoing mail, letting the receiver use a public key published in your DNS to verify that the message really came from your domain and was not altered in transit. Without it, DMARC cannot pass for forwarded mail, which is where most alignment failures show up. Use a 2048-bit key where the platform supports it, and give each sending tool its own selector so one can be retired without touching the rest.