Alignment failures
DMARC asks for more than SPF or DKIM passing: the domain that passed has to align with the domain in the From address your recipients see. A sender that passes SPF and still fails DMARC almost always has an alignment problem.
The two "from" addresses
- Header From: the address people see, such as
ceo@example.com. - Return-Path (envelope from): the address servers send bounces to, such as
bounces@mailchimp.com. SPF is checked on this one.
The alignment rule. At least one of SPF or DKIM must pass on a domain that shares its organizational domain with the Header From. With relaxed alignment, the default, news.example.com aligns with example.com; with strict alignment (aspf=s / adkim=s) the names must match exactly.
A common case: marketing tools
Out of the box, many marketing tools send with their own bounce domain and sign with their own DKIM key. SPF passes for mailchimp.com, which does not align with example.com, so DMARC fails even though nothing is wrong with your SPF record.
The fix
In the tool's settings, authenticate your domain: turn on DKIM signing with your domain, and, where the tool offers it, a custom return-path (bounce) domain under yours, such as bounce.example.com. Either one aligns. The sender card on the DMARC page tells you which of the two is missing; see Reading your senders.