Message authentication methods such as SPF, DKIM, and DMARC can be used by a message recipient to determine whether the domain of the apparent sender may have been spoofed. These standards are based on information published in the DNS for the sender’s domain.
In the case of SPF, an SPF record is published in the DNS for a domain to specify the SMTP servers that are authorized to send mail from senders in that domain. If a spoofer tries to send a message appearing to be from *@paypal.com, he is unlikely to be able to relay the message through one of the SMTP servers designated in the SPF record for paypal.com. If he tries to send the message through a SMTP server other than one that is designated in the SPF record for paypal.com, the recipient’s spam filter would likely detect this mismatch and determine that there is a high likelihood that this message was spoofed. As pointed out in the comments by @SteffenUllrich, the shortcoming of SPF is that it only applies to the domain of the sender address in the MAIL FROM of the message envelope, which is generally not seen by the recipient. However, DMARC can be used in conjunction with SPF to apply to the sender address in the message headers as well.
In the case of DKIM, a DKIM record containing a public key is published in the DNS of the domain. A signature over a hash derived from the message body and headers is created using the private key corresponding to that public key, and this signature is included in the headers of the message. If a spoofer attempts to send a message appearing to be from *@paypal.com, he would not have the private key, and therefore would not be able to create a valid signature. Therefore, if the recipient’s spam filter is able to verify the signature using the DKIM public key published in the DNS of the purported sender’s domain, then it’s unlikely that the message was spoofed.
As pointed out by @SteffenUllrich, all of the above frameworks validate the sender’s domain, but not the particular sender. In addition to (or instead of) these frameworks, the sender can sign the message using an S/MIME or PGP/GPG signature. If the recipient has the sender's public signing key, then the recipient can use the public key to verify the signature. If the signature verifies, then this proves that the sender (or someone else that has the sender's private key) signed the message.