If you’re using Gmail, you’ll see three vertical dots in the upper right-hand corner of the message. Click on this and choose “Show Original.” You should then see the pass or fail status of SPF, DKIM, and DMARC to indicate whether it is legitimately from your organization. Your safest bet, however, is to initiate a new email to your boss asking if she emailed you about a password.