The point about the From domain being different from the domain that passed SPF and DKIM is where most alignment failures hide. Before moving to enforcement, sending a test message from each tool that mails on your behalf and reading the Authentication-Results header will show which one is misaligned. Are the billing and support tools usually the ones that fail first?
StackShortlist
Proof Over Promises.
The point about the From domain being different from the domain that passed SPF and DKIM is where most alignment failures hide. Before moving to enforcement, sending a test message from each tool that mails on your behalf and reading the Authentication-Results header will show which one is misaligned. Are the billing and support tools usually the ones that fail first?