Mail using your domain that is not yours

A sender is using your domain in the From header of its messages, and none of that mail authenticated as you — no SPF you authorize, no signature from a key you publish. Sojka marks it separately from the rest of your failing mail, because it is a different problem with a different fix.

Why there is nothing to align

Alignment is something a sender you control can be made to do: you authorize its servers in SPF, or you let it sign with a DKIM key published under your domain. A sender that is not yours has neither, and no change to your DNS will give it one. That is the point — DMARC is not a way to fix other people's mail, it is a way to tell receivers what to do about it.

What actually stops it

Your DMARC policy, and only your DMARC policy.

• p=none — receivers report this mail and deliver it anyway. Every message you see here reached somebody's inbox with your name on it.
• p=quarantine — receivers put it in spam.
• p=reject — receivers refuse it at the door and it never arrives at all.

So the work is not on this sender. It is on getting your own mail authenticating cleanly enough that you can tighten the policy without catching yourself in it. That is exactly what the readiness advisor tracks, and why it holds when your own sources are not ready: the moment the policy tightens, anything of yours that does not align is treated the same way this sender is about to be.

If this sender is actually yours

Say so. Sojka works this out from evidence — whether the address ever authenticated as you, whether it belongs to the platform that handles your mail, whether you have verified it — and evidence runs out. A tool you signed up for last week, a mailing service somebody else in the company bought, a server that has never been configured to sign: all of them can look exactly like a stranger.

Marking it as yours moves it into the alignment list, where the advice becomes the useful kind: authorize it in SPF, switch on its custom-domain DKIM setting, and watch it go green.

What Sojka is and is not claiming

That this sender has never authenticated as your domain is a fact, taken from the reports your receivers sent. That it is hostile is not something a DMARC report can establish, and Sojka does not assert it. Plenty of unauthenticated mail is somebody's forgotten integration rather than an attack. The response happens to be the same either way, which is convenient: tighten the policy, and legitimate senders you had forgotten about will make themselves known by breaking.