[wizofaus]

But there are still no truly widely used standards to ensure emails are actually from the claimed sender. Many of the most popular phone-based email apps (including Google's) don't even show the from/reply-to addresses by default, and often make it hard to determine what URLs embedded links refer to.

[brightball]

Verifying they are from the actual domain is a huge step in the right direction though.

Beyond that, there’s still plenty of work to do but the surface area covered by wide spread DMARC adoption is huge.