An hour a year is the wrong shape for the thing it is trying to teach. Spotting a forged header or a hidden instruction is pattern recognition, and pattern recognition decays — so the fix is not a better annual module, it is two minutes a day.
Short links hide the destination, and that's the point of them. One curl command tells you where a link lands before you commit to going there, and there's a version for people who don't live in a terminal.
Most domains are still wide open to spoofing, and the owners have no idea. You can check yours in about thirty seconds with dig, and you don't need to be the person who runs the mail server to do it.
SPF, DKIM and DMARC can all pass on a message designed to rob you, and routinely do. Here is what each check actually asks, which one looks at the address you can see, and why three green ticks are so often a statement about a domain you were not looking at.