DKIM, DMARC, SPF, rDNS/PTR, EHLO... all correct and verified in the email "original source," BY GOOGLE. Still goes to SPAM folder because **** you, apparently. I hate Google.
I use a free outbound smtp relay that lets me do like 5k emails on the free tier. I use it primarily for alerts and Immich updates / new user links. But I don't do inbound so don't have to expose any ports. Only time I did was to do validation with the relay so just a few minutes during setup.