[winstonwinston]

Realistically spoofed address (unauthenticated email) will be treated as spam and it’ll be implicitly quarantined or rejected as such by many well-known mail receivers. You can make this an explicit “reject” by publishing DMARC policy for your domain.

For example, gmail.com treats unauthenticated email as spam implicitly, regardless of DMARC policy.