How to prevent email spoofing, using an unholy combination of silly standards