DMARC fails if "Return-Path" is different than "From", and so the mail gets marked as spam.

"Return-Path" is usually automatically set by the MTA, but it can be forced this way:

mail(..., ..., ..., ..., '-f sender@example.com');

This should be done automatically by SecureMailer.class.php