Emails in email spoofing definitely show a legitimate domain in "From"; it wouldn't be fun otherwise. Look at the headers. All the domains in the many "Received" fields, "Return-Path", etc.
Look not for signs it is authentic; look for signs it is not.