“I was greatly surprised to see that the forged email had passed Gmail’s DKIM/DMARC checks.”
A spammer sent mail from a junk domain registered in India. Gmail stamped it as genuine youtube.com mail, with DKIM and DMARC both passing. The headers show it bounced through a google.com server on the way in. The same address had been at it since at least August 2021. Google built the checks that are supposed to stop this, and its own servers vouched for the fake.