If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.
Yeah, as soon as I saw this post I thought of SPF and DomainKeys.
Seems simple:
If your mail/DNS is setup to support either of these, then cool you don't need to confirm.