If you do self host I suggest reading carefully the Gmail guidelines for mails. They are the leaders in the field and they dictate the level of security required.
DNS forward and reverse, DKIM, SPF, DMARC, ARC, DANE, bounce signature etc. Email is indeed a very complicated thing to host. I work on emails system all day and and I wouldn't host my own mail.
Even worse I'm hoping email disappear and another technology takes it place. Emails are unreliable and outdated, they need to go.