FindUtils

Good catch, and thanks for reading it this closely. That's the alignment trap: SPF can pass for the sending service's bounce domain while DMARC still fails, because DMARC wants the domain it checks to match the visible From. Worth a line in Step 2. Appreciate it!