The point about the From domain being different from the domain that passed SPF and DKIM is where most alignment failures hide. Before moving to enforcement, sending a test message from each tool that mails on your behalf and reading the Authentication-Results header will show which one is misaligned. Are the billing and support tools usually the ones that fail first?