SPF
Keep the include chain lean, aligned to the real envelope sender, and below lookup limits.
DKIM
Sign every stream with domain-aligned selectors and rotate keys before they become operational debt.
DMARC
Move from monitoring to quarantine after source review so policy starts protecting inbox trust.