While the individual messages were not yet signed, Gmail should have already rejected any message claiming to be from my domain that was not sent by my own server.