Hi,
Error address field is misnamed, it's the Sender header of the message from RFC-5322/3.6.2; The Sender field is From header .
Authorized mask is to safeguard users from using the wrong From/Sender subdomains, since these are sensitive and can impact reputation, i.e. if users send phishy emails ISP's can lose trust in the IP's. Put *@subdomain in sender mask and the full error address in error mask.
Error address you set to the bounce mailbox used by inmail, which has to be configured in External Accounts/Bounce mails.
The product doc has a lot of useful info about deliverability in Campaign.
Thanks,
-Jon