Symptom: DMARC aggregate reports show failures for your domain, or receivers quarantine/reject authenticated-looking mail.
Cause candidates:
1. SPF/DKIM not aligned with the From domain (e.g. sending from a subdomain or via a service that signs with its own domain).
2. Forwarding or mailing-list rewriting breaking the DKIM signature.
3. The From domain differs from the authenticated domain (the classic single-sender-on-gmail warning: inbox-provider domains fail DMARC).
Confirmation: read your DMARC aggregate reports. They name which checks failed per source.
Fix:
1. Authenticate the exact domain in the From header with domain auth (SPF + DKIM via SendGrid's DNS records).
2. Start the DMARC policy at p=none to monitor, then move to quarantine, then reject, only when reports are clean.
3. Keep every third-party sender for the domain authenticated too; one unsigned service fails the domain's DMARC.
Verification: DMARC reports show SPF and DKIM passing and aligned, and the failure count drops to zero before tightening the policy.