Like many other companies, Google uses a system called DomainKey Identified Mail (DKIM) to validate that mail sent from Google.com really comes from Google, and not from a scammer pretending to be Google.
FORBES: Google Says Google Apps Domains Were Protected From Massive Spoofing Vulnerability