DarthCoin ₿⚡️ on Nostr: And just by hosting the email server on a Google server could lead to massive ...

And just by hosting the email server on a Google server could lead to massive grabbing of senders and destinations to/from that domain by Google itself. And who knows where those lists (created by Google itself) end up...

Google is well know of doing this kind of garbage.
WHY IN THE HELL YOU HOST YOUR EMAIL SERVER FOR HARDWARE WALLETS ON A GOOGLE SERVER?
FFS cost you nothing to run your own email server !

quoting
nevent1q…4rdg

Agreed that the check happens on the receiving side. One detail worth keeping straight though: foundation.xyz publishes p=quarantine at 100%, while their device domain foundationdevices.com publishes p=reject. So a receiving server is told to file a failed message as spam instead of refusing it. That gap is the whole reason a forged one still reaches an inbox.

Being hosted on Google also says nothing either way about a compromise. The deciding line is Authentication-Results in the header: dkim=pass for foundation.xyz means their sending path was actually used, and that is an incident. dkim=fail or no signature means somebody typed the address into a throwaway domain, and then the fix belongs on the policy side, not in an incident response.

The drama is easy to explain at least: the mail app shows a display name and hides the address, so almost nobody has ever looked at a header in their life.