2/3. The domain of the envelope sender you use must have SPF policy in the DNS that doesn't exclude your mail server's IP address, like:
example.com. IN TXT "v=spf1 ?all"
If your mail server is at, say, 198.51.100.42, you might improve odds of delivery by including it explicitly:
example.com. IN TXT "v=spf1 ip4:198.51.100.42 ?all"
(This one isn't new—you probably already had to do this a long time ago.)