To complement Steffen Ullrich's answer, note that:
- Historically, it was indeed possible to spoof anything you wanted, no-one checked, everybody trusted everybody.
- However, with the rise of spam, phishing and other scams, SPF, DKIM and DMARC were introduced. Those allow a server to check if the sender does have the right to send mail with a sender in a given domain.
- To work, those require both the sender and the receiver to implement those methods.
- Most large e-mail providers will definitely implement at least one of the 3 methods on their side (as a receiver), and many organisations at risk of having people trying to impersonate them will implement at least one of the 3 methods on their side as well (as a sender).
- However, there are still both e-mail systems not checking either and domains without the appropriate setup.
So if you find a domain without SPF, DKIM or DMARC, you could send e-mail on behalf of that domain and not be rejected outright. Many e-mail providers will "trust" such e-mails less that others, and it has larger changes of being handled as spam.
Likewise, you could send e-mail even "from" a domain protected with SPF, DKIM or DMARC to an e-mail system that doesn't check it.
But most definitely, it you want to send as Apple or Amazon to mailboxes managed by Google or Microsoft, that won't work. And that's the reason they use other domain names for this.