Domain alignment is essential to DMARC. DMARC always refers to the From header domain. SPF validates the envelope sender (MailFrom) domain. DKIM can validate any domain, even one not used anywhere else in the message. For DMARC to succeed, the From header domain must align with a domain whose validation mechanism succeeds.
All of that makes sense. Anyone know why a sizeable percentage of emails from the dovecot mailing list fail dmarc? Is dovecot doing something wrong or is it users with improperly setup dkim keys? Because it seems like mail from the postfix mailing list always pass dmarc.
