Ask HN: Can Email Scammers Bypass SPF, DKIM and Dmarc Verification? Maybe

I just got an email from paypal saying they were going to send me a debit card unless I wanted to opt out. It was positioned as a "free business account upgrade" email. It had no typos, it was fully branded and it looked legit. The headers showed that it was indeed sent from mail.paypal.com and SPF, DKIM and DMARC passed verification. But all of the links lead to this domain: https://epl.paypal-communication.com The "Received" header came from: mta113b.pmx1.epsl1.com (mta113b.pmx1.epsl1.com. [142.54.244.113]) And that 142.54.244.113 IP address is also used for the Received-SPF header which passed. Can someone explain how this happened? That IP address according to Google has a number of abuse complaints filed against it so I doubt it's really from PayPal.