how does DKIM work with cfmail, is it handled at the mail server level or is there a special header we need to send with the mail? We’re using Office 365 as the mail server but I’ve never implemented DKIM with coldfusion anyway

You shouldn’t need to do anything with cfmail. It should just work. If the SMTP server is office 365 then it should handle the DKIM and other SPF validations. You are probably aware but if you are sending bulk email via O365 make sure you have the spool enabled on cf and slow the spooling to match the config on O365.. We have no end of problems with Office 365 blocking bulk mailings. We usually try to encourage the client to use Sparkpost or Sendgrid to improve the send reliability.

It's configured in the mail server and your DNS. I haven't used Office365 but I expect it will provide the public keys to use in your DNS records. CF doesn't need to know anything about it.

salted, use something like mxtoolbox.com to verify whether or not a given domain has all the appropriate records set up. most, if not all, of the security/authority types of records related to mail delivery are done at the DNS level and aren't specific to cfmail or mail clients per se. most are just TXT records that need to be created