Envelope From vs header From
The envelope From is the address in the SMTP MAIL FROM command. The header From is the mailbox listed in the message's From header field. RFC 5321 defines the envelope; RFC 5322 defines the message header.
SPF authenticates the domain name used in the SPF check, which is usually the envelope From domain or the EHLO domain. DMARC alignment compares the header From domain to the SPF or DKIM domain according to RFC 7489.
Why they diverge
Mailing lists, CRM tools, and transactional providers often send with a bounce address at a provider domain while the header From remains the customer's brand domain. That is valid SMTP if both addresses are permitted.
DMARC fails when the customer publishes a strict policy but the envelope domain that passes SPF is not aligned with the visible From domain, unless DKIM signs with an aligned d= domain.