SPF and DKIM can both pass while DMARC fails because DMARC evaluates alignment with the visible From domain. The question is not only whether a signature or sending IP is valid, but whether at least one authenticated identifier aligns with the domain the recipient sees.
Read the actual Authentication-Results
Use a received test message and record header.from, smtp.mailfrom, DKIM d= and the DMARC result. Do not infer alignment from DNS alone.
Check SPF alignment
SPF may pass for a bounce/return-path domain owned by the provider but fail DMARC alignment with the visible From.
Check DKIM alignment
A valid DKIM signature can use a provider domain. Ensure at least one passing d= domain is aligned under the chosen strict/relaxed mode.
Account for forwarding
Forwarders can break SPF while preserving DKIM. ARC can provide context but does not remove the need for a sound sender configuration.
Inspect subdomain policy
DMARC sp= and organizational-domain rules can make a subdomain behave differently from the root domain.
Retest after DNS changes
Use the same sender/path after propagation and compare headers. A dashboard green check is weaker evidence than a real received message.
Compare with the DKIM troubleshooting guide and the multi-sender SPF guide.
Build a one-message alignment matrix
Put the visible From domain beside SPF result and smtp.mailfrom, then DKIM result and d=, and finally DMARC result. Mark which authenticated identifier actually aligned. This compact matrix prevents a common mistake: seeing two PASS values and assuming DMARC must pass, even though both passes belong to domains different from the one shown to the recipient.