> Assuming malicious actors can easily set up all the fancy acronyms to verify the sender’s identity How is a malicious actor going to set up a fake SPF record

> Assuming malicious actors can easily set up all the fancy acronyms to verify the sender’s identity How is a malicious actor going to set up a fake SPF record for my domain without compromising my DNS account? It makes sense to block a domain even with a correct SPF record. It makes no sense to block an IP with a correct SPF record for a domain that you already trust. And, like I said, I'm getting bounced mail from people I've been corresponding with for years, so I know the recipient email providers do trust the domain. They're just being stupid with IP black listing.