I don't think that's an accurate characterization. If you have an email with a DKIM signature, from Gmail or from a myriad of vendors, then either: a. The emai

I don't think that's an accurate characterization. If you have an email with a DKIM signature, from Gmail or from a myriad of vendors, then either: a. The email is authentic. b. The service allows whoever administers the service to configure outgoing emails however they please. c. There is a documented method by which the service allows you to override the sender address. d. The service has risked its reputation to "forge" the signature. The middle two options are extremely common in any business setting. Gmail supports both. -- I am assuming, since your post does not appear to be agreeing with the parent comment, that when you say "authentic" you mean "sent or authorized by the individual named in the username field". If you mean "sent in a manner configured by some entity with authority on how the domain is used for sending email", then that is exactly the parent comment's point.