Maybe you just need to invest some money in better spam filters, and user education.
Better user education is a non-starter.
I think we need go further: what we need to do is kill the idea that email is an good vector for notifications inside of big organizations (or maybe even outside of them). I should have a dedicated app with a whitelist based system that official notifications go through. This could be not only a security improvement, but also a stab at better UX, better productivity, and avoiding notification fatigue.
Wouldn't a CNAME cover it? It's the way that gmail.example.com gets routed to google's servers.