DKIM
A cryptographic signature proving an email really came from your domain and was not altered.
DKIM, DomainKeys Identified Mail, adds a signature to each outgoing message. The matching public key sits in your DNS, so any receiving server can verify both that the domain signed the message and that nobody changed it along the way.
Unlike SPF, DKIM survives forwarding: the signature travels with the message rather than depending on which server handed it over last.
Setting it up means publishing a key your sending platform generates. It is a one-time job per domain and per platform.