End users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem.

If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.