The sender of the email needs to do dns resolution properly and securely (for instance, using DNSSEC to have origin authentication), and the domain of the email needs to have sole control of the ability to add DNS entries.
If those hold, then the security should be equivalent to the email account's own security.
If those hold, then the security should be equivalent to the email account's own security.