I've had it setup with protonmail for a year now and it works very well, easily automated with providers such as AWS route53 for example. So technically I could have hosted my own email that whole time, just replace the protonmail senders with my own.
As long as I get a VPS IP without a tainted reputation.
One thing that does work to combat these SPF+DKIM+DMARC valid sources, I've found, is to reject all email from supposed email servers which either don't have working reverse DNS or which have reverse DNS which has a name that differs from the HELO / EHLO name.
It used to be enough to just insist on working reverse DNS that has matching forward DNS resolution, but recently I've been testing requiring that "Return-Path" has the same domain as the HELO / EHLO.
Another thing that I've noticed but I'm not sure how to check in sendmail is to reject email that has a "Return-Path", "From", "To", or "Reply-To" that's a Gmail address when the email isn't from Gmail. I'd like the same test with Outlook / Hotmail and Yahoo. I've found almost no instances of legitimate email sent this way.
Many things to consider, now that SORBS is one less tool to use!
This also involves promoting sender domains from 'DATA reject' to 'MAIL FROM reject' based on behavior, since most spammers see 'MAIL FROM accept' as a win, and won't check any further results.
Nothing prevents spammers from setting up their own domain with valid spf, dkim, dmarc.