I follow the usual best practices and set up DNS TXT records for Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC). Only DKIM requires configuring the MTA for it because the MTA needs to know where the DKIM private key is to sign emails and what the DKIM selector, domain, etc. should be in the DKIM-Signature header. From my Makefile[1]:

  # --------------------------------------------------------------
  # Enabling DKIM ...
  # --------------------------------------------------------------
  echo DKIM_CANON = relaxed >> /etc/exim4/exim4.conf.localmacros
  echo DKIM_SELECTOR = s1 >> /etc/exim4/exim4.conf.localmacros
  echo DKIM_DOMAIN = $(FQDN) >> /etc/exim4/exim4.conf.localmacros
  echo DKIM_PRIVATE_KEY = /etc/exim4/exim.key >> /etc/exim4/exim4.conf.localmacros
  openssl pkey -in /etc/exim4/exim.key -pubout -outform DER | base64 -w 0 > /tmp/publickey

After that, it is just a matter of adding the necessary TXT records for SPF, DKIM, and DMARC to the DNS zone. The relevant section in the Makefile[2]:

  # --------------------------------------------------------------
  # Generating DNS records ...
  # --------------------------------------------------------------
  @echo "Add the following TXT records to DNS:"
  @echo
  @echo "@ TXT v=spf1 mx -all"
  @echo "s1._domainkey TXT p=$$(cat /tmp/publickey)"
  @echo "_dmarc TXT v=DMARC1; p=reject; adkim=s; aspf=s"

Having said that, I have also found in the past that major email providers would accept emails sent by my MTA just fine even without these measures. For a long time, I did not have SPF, DKIM, or DMARC enabled and I did not observe any issues. However, it is a good practice to use these measures to make it harder for a bad actor to spoof and send spam that appears to originate from your domain.

[1]: https://github.com/susam/susam.in/blob/7cff99b/mta/Makefile#...

[2]: https://github.com/susam/susam.in/blob/7cff99b/mta/Makefile#...