In your scenario, the fundamental issue stems from DMARC's domain alignment requirement. Let's break down the headers from your example:

From: Website User <website-user@gmail.com>
Return-Path: <account@mywebserver.com>
DKIM-Signature: d=mywebserver.com
Authentication-Results: 
   spf=pass smtp.mailfrom=account@mywebserver.com
   dkim=pass header.i=@mywebserver.com
   dmarc=fail header.from=gmail.com

DMARC operates on the From address because:

1. User Visibility: The From header is what recipients actually see in their email clients
2. Phishing Prevention: It prevents domain spoofing in the visible sender field
3. Technical Implementation: RFC 7489 specifically defines DMARC to authenticate the "RFC5322.From" domain

Here are three approaches to maintain both deliverability and accurate sender representation:

Option 1: Sender Header Method

From: "Website User via MyWebServer" <noreply@mywebserver.com>
Sender: website-user@gmail.com
Reply-To: website-user@gmail.com

Option 2: Domain Alignment with Subaddressing

From: "Website User" <forwarding+website-user=gmail.com@mywebserver.com>
Reply-To: website-user@gmail.com

Option 3: API-Based Forwarding (PHP Example)

<?php
$to = 'webformrecipient@mywebserver.com';
$subject = 'Form Submission';
$message = '...form data...';
$headers = [
    'From' => 'formprocessor@mywebserver.com',
    'Sender' => 'website-user@gmail.com',
    'Reply-To' => 'website-user@gmail.com',
    'DKIM-Signature' => '...',
    'Return-Path' => 'bounces@mywebserver.com'
];
mail($to, $subject, $message, $headers);
?>

For proper DMARC implementation:

• Set p=none initially for monitoring
• Gradually move to p=quarantine after achieving >95% alignment
• Use tools like dmarcian.com to analyze reports

For Postfix users, modify /etc/postfix/main.cf:

smtpd_sender_login_maps = hash:/etc/postfix/sender_login
smtpd_sender_restrictions = reject_sender_login_mismatch
smtpd_discard_ehlo_keywords = silent-discard, dsn

The fundamental challenge occurs when email systems implement DMARC (Domain-based Message Authentication, Reporting & Conformance) differently from SPF and DKIM. While SPF and DKIM validate the envelope sender (Return-Path), DMARC specifically examines the From: header address - creating alignment problems for webform submissions.

// Typical email headers showing the discrepancy
Return-Path: <account@mywebserver.com>  // SPF/DKIM check this
From: Website User <website-user@gmail.com>  // DMARC checks this
Sender: webformrecipient@mywebserver.com  // Often ignored

This architectural difference stems from DMARC's primary purpose: to authenticate the visible sender (what recipients see in their inbox) rather than the technical sender (used for delivery).

When your webform sends messages with:

• SPF pass (valid Return-Path domain)
• DKIM pass (valid domain signature)
• DMARC fail (From-domain ≠ authenticated domains)

Gmail's filters detect this misalignment as potential spoofing - even when legitimate.

Option 1: Rewrite the From header while maintaining transparency

// PHP mail() example
$from = "User Submission via MySite <forms@mywebserver.com>";
$reply_to = $user_email;  // Actual visitor's email
mail($recipient, $subject, $message, [
    'From' => $from,
    'Reply-To' => $reply_to,
    'Sender' => 'account@mywebserver.com'
]);

Option 2: Implement RFC 8058 (Third-Party Authorization) with ARC

// Example Authentication-Results header with ARC
Authentication-Results: mx.google.com;
    arc=pass;
    spf=pass smtp.mailfrom=account@mywebserver.com;
    dkim=pass header.i=@mywebserver.com;
    dmarc=pass header.from=mywebserver.com

The protocol architects prioritized these security considerations:

1. Phishing prevention - users react to visible From addresses
2. Domain reputation protection
3. Ecosystem alignment with what recipients actually see