SPF passed. DKIM passed. DMARC failed. Nothing is broken.

This header block is where most people's understanding of email authentication falls apart: Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=bounce@esp-vendor.net; dkim=pass header.d=