Somehow I manage it for quite a few domains.

You have to do email due-dil and off you trot. Gmail, MS and co really do respect the rules in my estimation and don't simply dump email out of spite.

If you go in with at least everything up to SPF working, you are normally good to go. DKIM and DMARC and all the rest are even better.

I run my own DNS too and am on good terms with upstream so DNSSEC is available. Like I said, it requires some effort but so do most things in life.