Which is why I think it was rather a moronic choice of domain on the part of paypal. But I know how to look for spf/dkim validation. A normal user (or a user using a mobile/tablet) will make a decision purely on the domain of a link.