While I’m thinking aloud, DMARC is also a really really good idea to prevent phishing. But setting policy to be none, you can start to quantify answers to the question: “Is my domain being used in phishing scams?”, and if it is, set policy to “reject” to ensure that all emails purporting to be from your domain that fail validation are dropped.

This accounted for a substantial drop in PayPal phishing attacks over the last few years. (https://dmarc.org/2015/02/kaspersky-phishing-attacks-on-paypal-down-due-to-dmarc/)