Message forwarding (including mailing lists) would be able to cause something like this.
If you have been sending a message to a mailing list on Google Groups, called “groupname”, Google Groups typically rewrite the envelope from to become something like “[email protected]
”, before passing the message on to me.
Since the envelope from @googlegroups.com
, that is being SPF
checked (likely with the result of SPF
pass) is no longer identical to your domain (e.g. @example.com
), the alignment will therefore fail.
Certain forwarders (including Cloudflare Email Routing) will do similar kind of envelope from rewriting.
Having a SPF
pass is not the same as having a SPF
pass with alignment towards the original (header From:) domain, and DMARC actually requires the latter to have a pass within the SPF aligned
field.