It's pretty smart if you're a spammer / phisher. Legitimate use-cases for this setup seem to be few and far between. I wonder how it handles (or skirts) the STIR/SHAKEN requirements in the US.