“Then, I encountered a second problem: I had no idea what those were, and seemingly nobody has written about SPF, DKIM, or DMARC in a way that a human can understand, not to mention implement.”
Stopping someone from forging email from your own domain takes three separate standards layered on top of each other. Each one patches a hole the last one left open. Get any of them wrong and your real mail lands in spam. Email was built without authentication, and everyone is still paying for it.