Hacker News Reader

Comment by LoSboccacc | Hacker News Reader

you can check that the envelop and message sender header match at the mx level and let spf handle the rest

There is no authentication of the John Doe part of

   John Doe <not.john.doe@example.com>

DMARC