Neither can I find out a technical description what is actually certified and how. Email seems like a very insecure concept. How do they verify who controls a m

Neither can I find out a technical description what is actually certified and how. Email seems like a very insecure concept. How do they verify who controls a mailbox/email address? Signing message contents I understand. But email headers can be faked in various ways.