They are not too hard in principle, but w.r.t implementation, even Google fails in some respects today with DMARC and its own Google Calendar (invite notifications bouncing within the same GSuite):
https://www.reddit.com/r/sysadmin/comments/c5p7e8/dmarc_bloc...