Is there a "best practices" document on these subjects?
Hello Dick,
Microsoft has not (yet) implemented DKIM on Exchange Server 2016 or 2019. Your only option is https://www.emailarchitect.net/domainkeys/kb/dkim_exchange_2007_2010_2013.aspx or https://github.com/Pro/dkim-exchange. If that is implemented you can implement DMARC.