The bank doesn't have to send the simulated phishing emails from their own domain. Actually I don't think they'll want to do it as it would lower the spam reput

The bank doesn't have to send the simulated phishing emails from their own domain. Actually I don't think they'll want to do it as it would lower the spam reputation of their domains. They should use shady domains like every real phisher.