&gt; I&#x27;m not arguing that we shouldn&#x27;t do anything. I&#x27;m arguing that the presentation of the data is at best meaningless and at worst downright harmful.<p>What do you think should be done to make progress that&#x27;s better than Google&#x27;s proposal? Personally I think encouraging all senders to adopt DKIM, transport layer TLS, DMARC, SPF, etc. by displaying auth results from those protocols in the UI is a good first step. It&#x27;s similar to the push for HTTPS on the web.<p>&gt; DKIM authentication is in no way an attestation that it was sent by its sender.<p>Google didn&#x27;t mention DKIM in the blog post we&#x27;re discussing. Are you referring to a related effort? The blog post was about encryption in transit with TLS.<p>&gt; I&#x27;m arguing that the presentation of the data is at best meaningless and at worst downright harmful.<p>Google&#x27;s DKIM solution is as close as one can reasonably get given modern technology. If I send a DKIM-signed email from example.com that passes validation, then it means the following is true: I sent an email through a server managed by the domain owner, that had access to the DKIM key and chose to sign my email. It&#x27;s not authenticating a person, but it&#x27;s authenticating that the domain&#x27;s mail servers sent the message. The attestation is at the domain level, not the sender level. This attestation is still useful though: if the domain owner did not want to allow you to send email from jcranmer@example.com, then it would not accept that email from you or DKIM sign it.