Hacker News Reader

You need to watch the email headers and look for the originating IP. Then you'll see if the presumed FROM address is what it says.

If it's an spoofed email, send an abuse report to the owner of that originating IP [+], including full headers and full body text.

[+] If the originating IP is from a country you know it won't give a shit, look for the next jump.

DKIM and SPF should help mitigate. Those are something the domain owner needs to configure.

Look at the Received: headers.