2 ms·

How do you fake DKIM though? That is as good as a TLS certificate. I suppose someone might've taken over your browser or email client, but then it is game over

• cm2187 8y ago
  Which is why I think it was rather a moronic choice of domain on the part of paypal. But I know how to look for spf/dkim validation. A normal user (or a user using a mobile/tablet) will make a decision purely on the domain of a link.