Somewhere else in this discussion someone compared it to peering, which is quite a good example. You grant (read: sell) permission to other people to deliver t

Somewhere else in this discussion someone compared it to peering, which is quite a good example. You grant (read: sell) permission to other people to deliver text messages to your subscribers. The very same way you get a text message from carrier A while being a subscriber of carrier B. Now enter international territory. You interconnect with lots of networks, each of which can (in my experience services like that were often from/cheapest in eastern Europe) hand out access to more people to send on their behalf. Google can only try to protect you in limited cases. Check if the mail says it is originated from Google and notice that it isn't (flags a lot of false positives, if you are a valid sender, sending in a non-standard way). Checking headers (easily forged for most parts). Things like SPF [1] where you, as the admin of a domain, can tell the world that really only host X sends mails on your behalf. The world might not care though - and the burden is again not on your very own 'carrier' (Google here), but on everyone on this planet that runs a domain. There might be other ways, but inherently this problem is unsolved. Unless you went to a key signing party and verify that the data you got was signed by the key that you _know_ belongs to the sender (and you trust him not to give it away. And you trust him not to lose control of it or at least revoke it). 1: https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework