When a domain has nine years of clean certificate transparency history, your mail filter trusts it. That's the problem.