Error codes

DMARC alignment failed

SPF or DKIM can pass on a domain that is not the From domain. DMARC still fails, because alignment is a separate check against the address the reader sees.

SPF alignment uses the domain SPF authenticated, which is the MAIL FROM domain, not the header From. DKIM alignment uses the d= domain in the signature. Relaxed mode compares organizational domains. Strict mode requires an exact domain match.