Getting a self-hosted Postfix box from "technically sends email" to 10/10, and the OpenDKIM misconfiguration that hides in plain sight.
Email has no central authority. Anyone can claim to be anyone. DNS fixes this: four TXT records (MX, SPF, DKIM, DMARC) tell receiving servers your mail is legitimate.
MX tells the world where to deliver. SPF publishes IPs authorized to send. Without them, mail bounces or lands in spam.
Cryptographically sign every message with a private key. Receivers verify the signature using a public key in DNS. Proves it came from you and hasn't been tampered with.
Tells receivers what to do if SPF or DKIM fail. Start with p=none to test. Graduate to p=reject for production. Monitor DMARC reports for spoofing attempts.