[jacquesm]

> Random checks do belong in a large scale mail system such as GMail. Their system only checks 1 in x emails for DKIM/SPF.

I'd imagine google has by now figured out how to make a cache work.

> Could you imagine running DKIM/SPF checks on EVERY single email coming in?

No, but I can imagine keeping a set of cached data per origin address.

> You're making the assumption that every delivery is going to the same server, running the same code, which tests the same checks... every time. - It doesn't, and won't.

Indeed. Unreliable by design.