Thanks for the elaboration that certainly adds useful context. While I personally am aware of DMARC and haven't been hit by this, I've heard from friends that s

Thanks for the elaboration that certainly adds useful context. While I personally am aware of DMARC and haven't been hit by this, I've heard from friends that small businesses aren't able to contact them on their gmail-address anymore due to them (the businesses) not having setup neither SPF nor DKIM. I fully agree that this shouldn't be the case anymore in this day and age, yet here we are. The "random"-bit is directly mentioned in Google's support article and I can't figure out what it means. Either they enforce it for a sender's domain or they don't. My best guess is that they randomly decide when to start enforcing it for new or (probably more likely at this point) previously known individual domains.