Agreed that the check happens on the receiving side. One detail worth keeping straight though: foundation.xyz publishes p=quarantine at 100%, while their device domain foundationdevices.com publishes p=reject. So a receiving server is told to file a failed message as spam instead of refusing it. That gap is the whole reason a forged one still reaches an inbox. Being hosted on Google also says nothing either way about a compromise. The deciding line is Authentication-Results in the header: dkim=pass for foundation.xyz means their sending path was actually used, and that is an incident. dkim=fail or no signature means somebody typed the address into a throwaway domain, and then the fix belongs on the policy side, not in an incident response. The drama is easy to explain at least: the mail app shows a display name and hides the address, so almost nobody has ever looked at a header in their life.