This problem is partially solved by DMARC/SPF/DKIM. There a few issues with DMARC, but the main one - adoption by senders is well below 100% so you just cannot

This problem is partially solved by DMARC/SPF/DKIM. There a few issues with DMARC, but the main one - adoption by senders is well below 100% so you just cannot block mail without DMARC. But the main question I have - does a typical mail users actually care about sender domain? I suspect - not at all. And I see two main reasons for this. First notion of domain is de-emphasized everywhere - browsers turned address bar into a search bar and make real URL hard to notice, MUA (e. g. Outlook) don't show full email for senders in an address book. Second problem - legitimate senders often behave in exactly the same way as phishers - use unrelated/unknown domain and give no way to verify that the domain is legitimate. For example Charter/Sirius ISP sends mail from domain customeremailnotifications.com [1] and I found no ways to see for sure that is domain is owned or used by Charter. My memory is fuzzy, but PayPal (or ebay) AFAIR used a phishy domain too, something like managemypaypal.com. A largish ZA utility sends mail from eskomstatements.co.za having the main domain eskom.co.za and of course there is no good way to verify that both domains owned/used by the same company. List can be continued. All this conditions users to trust mail which is coming from a random-domain-registered-by-phishers, because legitimate senders do the same. [1] https://www.reddit.com/r/Spectrum/comments/dfpres/email_domain_customeremailnotificationscom_for/ https://www.reddit.com/r/Spectrum/comments/dfpres/email_doma... (1 year old, but situation hasn't changed a bit)