I see a lot of people confused, and it is confusing. Here's my best take at clarifying the issue for you: It's as if Google sent you an official email from an

I see a lot of people confused, and it is confusing. Here's my best take at clarifying the issue for you: It's as if Google sent you an official email from an @gmail address. Like "gmail-invoices@gmail.com" Surely it would look suspicious, and if it turns out it is official, it doesn't somehow mean there's no issue, if anything it's worse because it untrains users' security protocols. Personally I'd ignore anything that comes out of one of these domains, even if it turns out an actual employee pushed it, if you can't publish something on the main domain, you don't have enough authority to speak for the company, may be skunkworking to avoid an internal protocl, I don't know, I don't care, it's not official, don't need to read it.