Why “but SPF passes” is not enough
DMARC does not check whether SPF or DKIM passed, but whether one of them passed for the same domain that appears in the visible From:. That is alignment, and it is the most common stumbling block.
A sending service using its own bounce domain produces exactly this picture: SPF passes, DMARC does not. The fix is either a custom return path on a subdomain of your own domain, or a DKIM signature carrying d=yourdomain.com.
The three causes, in order of frequency
- No alignment despite an individual pass. As above — the provider sends under its own domain.
- DKIM is missing and SPF breaks on forwarding. With SPF alone, every forwarded message is lost.
- A sender was never authenticated at all. Shop, CRM or monitoring sends under your main domain without SPF or DKIM set up for it.
The honest way back
The temptation is to dial the policy back to p=none. That lets the mail through again and postpones the problem — the affected senders stay unauthenticated.
Better: publish rua=, collect aggregate reports for two weeks and read which sources actually send under your domain. Only once every legitimate source passes in alignment does p=reject work without collateral damage.