[hansvm]

Check the outbound IP of the physical machines sending the mail, and any other potential identifiers in the raw email which might have poor or zero reputation from other parties. You aren't graded just based on the official crypto signatures.

Also, did that domain ever send shitty emails? Opt-out marketing is the most common offense I've seen from otherwise above-the-board businesses (no matter how justified you think you are or how great your product is, no rando wants to hear from you, and your paying customers definitely will be pissed off that they paid good money and still have to filter out marketing for the privilege of using your project -- you'll definitely end up in the spam bin).