End users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem.

If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.

But wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.