The whole idea of DKIM and SPF checks and even DMARC policy is to fulfill the “integrity” part of the email communication by authenticating it to prevent unauth

The whole idea of DKIM and SPF checks and even DMARC policy is to fulfill the “integrity” part of the email communication by authenticating it to prevent unauthorized parties to send emails on behalf of a domain they don’t own. For DKIM, the mail you send will have the public key, then the header is signed with the mail server private key, similarly, the recipient side use the public key to verify the private was used, and to make sure the email was not tampered with in the way. Now, that boring theory to show that the idea is to prove it was you (the domain) who sent it -keep in mind DKIM won’t prevent spoofing, it’s meant to prevent spam, you should combine DKIM with your DMARC policy to make sure the domain in Form is not altered-, so trying to find a way that you can says later “it probably wasn’t me” defeats the purpose of these integrity checks, and doesn’t even make sense to be honest, if you’re too concerned about leaked emails, encrypted it with GPG, still not the most optimal solution since meta-data is still leaking, at the end of the day, emails are not meant for secure communications.