Envelope vs header From
Every email has two From addresses: the invisible one bounces go to, and the one recipients see. They do not have to match.
See it
What it is
Every email carries two sender identities. The envelope From (the address given in the SMTP MAIL FROM command, RFC 5321) is written on the outside of the delivery envelope: it is where bounces go, and no reader ever sees the command itself. The final receiver usually records it by stamping a Return-Path header onto the delivered copy, which is why the two names get used as synonyms even though one is a protocol command and the other is a header added at the end of the trip. The header From (RFC 5322) is the letterhead inside, the name and address the inbox actually prints. Nothing in SMTP forces the two to match.
This split is the whole reason email authentication is confusing. SPF checks the envelope domain. DKIM signs the message and claims a domain in its d= tag. DMARC ignores both unless one of them lines up with the header From, since that is the only address a human can be fooled by. When your ESP owns the envelope domain, Gmail prints 'via mailer.example.net' next to your name.
Gotcha worth memorizing: forwarding leaves the header From alone, but what happens to the envelope depends on the forwarder. A plain forward often keeps your envelope sender and simply relays from an IP your SPF record never authorized, so SPF fails at the second hop even though nothing was faked. A forwarder running SRS rewrites the envelope into its own domain instead, so SPF passes for the forwarder and still aligns with nothing of yours. Either way the SPF result stops being useful, which is why DKIM alignment is the survivable one. Also do not confuse either of these with Reply-To, which is a third address that only affects where a human's reply lands.
Ask AI for it
Diagnose the sender identities and alignment evidenced by the raw email headers I paste below. Separate the envelope sender (as recorded in Return-Path, RFC 5321) from the visible header From (RFC 5322) and show the domain of each. Then read the Authentication-Results header and tell me which domain SPF authenticated, which domain DKIM signed (the d= tag), and whether DMARC alignment passes via SPF, via DKIM, or not at all. Split your conclusions into two lists: fixes I can infer from these headers alone, and the provider-side configuration still needed, naming what I would have to look up in the sending provider's dashboard. Do not predict whether Gmail will show a 'via' annotation as a deterministic result, since that depends on the whole authenticated identity Gmail resolves.