Getting SPF, DKIM and DMARC right starts with DNS. We've written a guide on where each record lives, the hosting mistakes that break authentication, and how to check your work. https://www.sealedmail.co.uk/resources/dns-hosting-email-authentication-records/