Symptom: 403 with an errors entry saying the from address does not match a verified Sender Identity.
1. Confirm it is not a scope 403: this message names the from address. A scope 403 talks about access. Different message, different fix.
2. Check which address the request actually sends from, including per-personalization from overrides. The top-level from is not always the one being checked.
3. Fix option A, domain authentication (production): Settings > Sender Authentication > Authenticate Your Domain, add the DNS records, validate. Every address on the domain then verifies automatically.
4. Fix option B, single sender (testing): Verify a Single Sender, fill the form, click the link in the verification email. No click, no sending.
5. Common trap: the address is verified but spelled differently in the request (typo, different subdomain, plus-addressing). The match is exact.
Do not work around this with someone else's verified address. Authenticate the domain you actually send from.