Mailjet, SPF und DMARC

The email passed SPF authentication, but was not DMARC SPF aligned because the RFC5321.MailFrom address was set to domain a1521675.bnc3.mailjet.com, which is not equal to firma.de (subdomains not allowed in DMARC strict SPF (aspf) mode).

The emails were sent using envelope address <sender>@a1521675.bnc3.mailjet.com
This is the RFC5321.MailFrom address, also known as the 'envelope' or 'bounce' address.  
The recipient cannot see this address in their email client, it is only used by the SMTP service.

The emails were sent using sender address <sender>@mail.firma.de
This is the RFC5322.From address, also known as the 'from address' or simply the 'sender'.  
This is the address visible to the recipient in their email client.

v=DMARC1; p=reject; rua=mailto:xxxxx; ruf=mailto:xxxxx; fo=1; pct=100; adkim=r; aspf=r