R3 — Known sender, alignment failure

Triggers when: for a known-sender source, the underlying SPF or DKIM check technically passed, but alignment against header_from failed — the most common cause is a third-party platform sending on your behalf without being configured to sign/send as your own domain.

What to do: configure the sending platform to use your domain for DKIM signing and/or the envelope sender, rather than its own, so alignment succeeds going forward.