You say .gov-ish, does this mean compromised gov email accounts, spoofed email addresses or domains that look like government domains?
You do not need to compromise anything, you can put any address in the "from" field. Email has no universal verification for sender address.
.gov is a US thing, and not even all US agencies use .gov ending emails.