In this case, the parent is using Google Apps, and is receiving forged outside emails &quot;from&quot; their own domain, to recipients within that domain.<p>The way to tell Google apps &quot;don&#x27;t accept outside forged emails from my domain&quot; is a DMARC policy, combined with the pre-reqs for that.  Google apps happily puts forged emails (from your own domain) into your inbox if you don&#x27;t.<p>&gt;&gt;DMARC is a message to other entities about what you want them to do in case DKIM&#x2F;SPF fails<p>Yes, but it also drives what your hosted Gapps&#x2F;Gmail instance does with incoming forged email for your own domain.<p>Google could provide a toggle or functionality to say what to do with failed DKIM and&#x2F;or SPF more generally, for all domains...but they don&#x27;t.  I can tell you for sure that messages with failures for both regularly land in the inbox within my Google Apps Gmail.