Email end users check the from field in their email clients to tell where an email comes from. However, SPF doesn't authenticate the field, neither does DKIM. This means "what you see might not be what's been authenticated". That's why the identifier alignment mechanism is introduced in DMARC…
