Does your application check DMARC alignment? Otherwise, a spoofed 'from' address will pass through. And also the sender's policy alone is not enough because, gmail.com and outlook.com have DMARC p=none.
Your domains are not aligned. We can't check DMARC. Before using DMARC, you should make sure the domains used in the Envelope From (e.g., Return-Path or Mail-From), the "Friendly" From (i.e., "Header" From) and the d=domain in the DKIM-Signature are the same