Close – it was DKIM! See the update to the post. Thank for your help 🙂