I started the "mnm" open source project to enable a new email network, on a new protocol.
More: https://mnmnotmail.org/
Follow: https://twitter.com/mnmnotmail
But the main question I have - does a typical mail users actually care about sender domain? I suspect - not at all. And I see two main reasons for this. First notion of domain is de-emphasized everywhere - browsers turned address bar into a search bar and make real URL hard to notice, MUA (e. g. Outlook) don't show full email for senders in an address book. Second problem - legitimate senders often behave in exactly the same way as phishers - use unrelated/unknown domain and give no way to verify that the domain is legitimate. For example Charter/Sirius ISP sends mail from domain customeremailnotifications.com [1] and I found no ways to see for sure that is domain is owned or used by Charter. My memory is fuzzy, but PayPal (or ebay) AFAIR used a phishy domain too, something like managemypaypal.com. A largish ZA utility sends mail from eskomstatements.co.za having the main domain eskom.co.za and of course there is no good way to verify that both domains owned/used by the same company. List can be continued. All this conditions users to trust mail which is coming from a random-domain-registered-by-phishers, because legitimate senders do the same.
[1] https://www.reddit.com/r/Spectrum/comments/dfpres/email_doma... (1 year old, but situation hasn't changed a bit)
I wonder if this could be fixed by email clients marking emails that fail DKIM as spam/attaching a large warning. Most users use email clients and they really don't do a great job of notify users of potential spoofing issues (with Gmail, you have to find "view original" to see that DKIM fails). I'm sure that spam filters would notice after a few hundred/thousand emails, but a successful spear-phishing attempt may not require that many emails. If customers complain about legitimate emails being marked as actually fraudulent, I'm sure adoption rates will increase.
However, if an org needs email, why can't they just configure their filters to move everything from outside the org in a special folder, and email server could further filter any link and put it through a warning page before redirecting to the link.
We already have DKIM and SPF to verify if the domains of the sender. Just setting up these can work.
https://mnmnotmail.org/faq.html
https://github.com/networkimprov/mnm/blob/master/Protocol.md
The mnm client app isn't chat-oriented like Slack & Discord, altho it does provide presence status for contacts who've opted into that.