Just noticed now PrivateEmail support DKIM. I started using their service since 2017, and at that time, only SPF is supported.

Still don't know how to set up DMARC, but I think with DKIM, nobody can send email on my behalf anymore.