header_from — the alignment anchor

header_from is the domain part of the From: header shown to the recipient in their mail client — what most people think of as "who sent this." DMARC deliberately anchors its alignment check here rather than on the technical envelope sender (SMTP MAIL FROM), because header_from is what actually deceives a recipient in a phishing attempt.

This tool attributes every report to a domain via policy_published/domain (the domain the DMARC policy was published for) rather than report_metadata, since the latter isn't reliably "which domain is this report about."