> Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is.
Does it verify the sender or the domain/service which the sender is using?
Does it verify the sender or the domain/service which the sender is using?
It's possible that gmail screwed up and gave Bob access to Alice's account. In this situation, though, Alice still sent it.