I have received a threatening message in my email [email protected] from my other email address [email protected]. Note that [email protected] is an alias to [email protected]. Also, of course, I own mydomain.com and it is registered in Google Domains. Message says my address [email protected] has been hacked and I want to find out if it's true.
Email went to spam. After inspecting email headers, I see SPF result is "neutral". I see here that it is possible to configure Gmail to send emails using alias addresses. I have never configured it, though.
First question Since primary address is managed by Google/Gmail and mydomain.com is registered also in Google (Domains), shouldn't SPF result be "pass"?
Second question Attacker says "I managed to log in to your email account [email protected]". Does it make sense? Is it even possible to login using an alias? Should I just assume it is a scam and ignore right now the message?