I agree they did something wrong. But I don’t run my own server - and I do run my own client.... And it’s not the MX that says where mail comes from, it’s the

I agree they did something wrong. But I don’t run my own server - and I do run my own client.... And it’s not the MX that says where mail comes from, it’s the SPF record (if you have one). Google had, for a very long time, an issue where any g-suite/gmail user could SPF as any g-suite domain; so servers that didn’t check DKIM (most until recently, and probably still) would let it through happily.