My previous employer used to send me an annual reminder on how to recognize phishing attempts, which I would annually report as a phishing attempt (despite knowing that it was legit) because it failed most of it’s own criteria. It would originate from an offsite third-party service, for which no SPF had been set up, and direct me to an off-site webpage for feedback. After a few years they did actually sort that out, so apparently sarcasm has it’s uses…