You could also use DKIM, you can see if message has been DKIM signed in Gmail by clicking "show more info" in webapp interface. But seeing as this is security

You could also use DKIM, you can see if message has been DKIM signed in Gmail by clicking "show more info" in webapp interface. But seeing as this is security company why didn't they at least sign their messages using PKI/PGP certificates? And why would they keep their entire email on their webserver?