Happy New Year! This is one of those under the hood questions. I want to set up DKIM/SPIF/DMARC on a VPS Hosted solution for about a dozen or so sites (yeah, I know I am late to the party on this one). I have SmarterMail on the same server as the CF instance. I currently have CFMAIL in the administrator to just dump the mail off and let the Windows SMTP service deliver (default localhost connection). When I harden email though, I am pretty sure that this is not the right approach. Will setting a a generic account in one of the mail domains set up in SmarterMail, and configuring the CFADMIN to use that account, and adding the IP of the CF Instance to the SPF record to take care of including any CFMAIL generated by the server to pass the email checks? Or am I going to need to add the security attribs to all the cfmail tags I have in each website? I searched but I am not really finding anything that explains how to set up CF to play nicely with DKIM/SPF/DMARC policies. Or do I just need to add the IP of the CF instance to the SPF record and leave the admin setting to use localhost?

Depends on your setup, but if you configure your CFML engine to deliver your mails directly to the MTA (even as a relay for localhost), then the settings are all done within your MTA and DNS. One issue could be the PTR entry for some mailproviders, because some do some fancy reverse checks, and you can always point a PTR to only one hostname per IP. That could be an issue in a multi-hostname environment.

@Andreas Your first sentence in the answer is the question I asked myself before I posted my request here. I don't use PTR on this server because it used to cause issues on the more heavily "email sender" websites. Non of these sites are bulk mailers, just low volume mom&pops, but email has recently gotten a bit iffy with gmail, so SPF and DKIM are where I am heading. BUt, since these are low volume, I really don't want to have to adjust ALL the cfmail tags, so looking for a "global" alternative

You could use Exchange Online Protection, it's still relatively low-cost and allows you to set up your senders per domain. Or you could invest in the maddening fun of SPF-DKIM setups with Postfix, per domain rewrite postfix rules,

If you are on a win box, you could try hmailserver as MTA, that allows to integrate DKIM really easy.

the cool part of hmail server is its entire configuration is db based.