Uh ... Your dkim settings are for your recipients to validate your emails. You should ALSO be checking dkim signatures on incoming e-mails (opendkim does that

Uh ... Your dkim settings are for your recipients to validate your emails. You should ALSO be checking dkim signatures on incoming e-mails (opendkim does that IIRC). Also, I forgot to mention that I REQUIRE tls for incoming smtp connection. That's another thing rising the bar for spammers. If you're using postfix, it's very open by default, in the sense that it doest not come with spf and/or dkim/dmarc tooling and it's not going to, for example, require (or even allow) ssl/tls for incoming smtp connections (and won't use it for outgoing smtp connection). One last thing: a little bit of spam leaks trough... But it's like less than a single spam email per two weeks.