Exactly. Need to see DMARC, SPF headers. Email headers are what you want to see. "From: <blah>" without those means nothing, and is trivially spoof-able.