Emails in email spoofing definitely show a legitimate domain in "From"; it wouldn't be fun otherwise. Look at the headers. All the domains in the many "Received" fields, "Return-Path", etc.
Look not for signs it is authentic; look for signs it is not.
Re:Ask HN: Suspended by Google Domains
by ml-engineer on Monday August 30, 2021 @01:09AM
(#28352957)
Sure, we did reach out to Google Domains support team. They acknowledged the case as valid, however, could not answer any questions about it (because it is being handled by the compliance team). We spoke with 5 different agents so far.
From: [email protected] Subject: A message from Google Domains SPF: PASS with IP 209.85.220.75 DKIM: 'PASS' with domain google.com DMARC: 'PASS'
The email said:
Hi there,
Your domain was reported for spamming activities and will be suspended in 3 days. ... It may result in cancellation of your domain registration or termination of your account.
Regards, The Google Domains Support Team
---
So far the experience has been exactly the same as how Gitbook described their similar situation: https://blog.gitbook.com/tech/post-mortems/06-20-gitbook-dom....
No one at Google would answer any questions. And we have no idea what to do right now.