5
Zero. It's trivially easy to spoof the from field to make it appear like the email came from someone else. DKIM is designed to provide authenticatation of mail servers, not individuals. The idea being that "valid" mail servers that normally send lots of emails (belonging to Google, Yahoo, etc) can be distinguished from spam mail servers.
2
It's trivial to spoof where an email came from.
There is really only one way to know with near 100% certainty that a given email really did come from a particular person: Ask them directly. I say near because they could always lie to you.
Other than that the only other real way to know is if that person has a personal certificate that the message has been signed and encrypted with and you have the key in order to read the message. However all that says is that someone with access to that signing key sent the email. Normally that's good enough.
For Police business it's usually good enough to establish the device an email came from and whether or not the person under investigation was reasonably the only person with access to that device during the time the email was sent. However, that can be pretty hard to do depending on how long ago it occurred, if the device is a home computer versus some type of mobile machine, the physical location the email was actually sent from, etc... Makes for a decent TV show though.
1
None.
Summary: SMTP doesn't provide any authentication, so it is easy to impersonate and forge emails. Modifying SMTP extensively, or replacing it completely, is not believed to be practical.
Conclusion: Certainty will increase, hopefully, when a new protocol is implemented.
Reference: here
2This seems like a security question – None – 2012-01-25T19:15:36.330
You've combined two different things, SMTP's
MAIL FROM
command and IMF'sFrom
header field. Both, however, can be spoofed. A valid digital signature is your best hope. – james.garriss – 2012-11-14T20:16:37.057