Alignment is what actually determines a DMARC pass or fail, not a raw SPF/DKIM pass. Relaxed alignment (the default) accepts any subdomain of the same organizational domain; strict alignment requires an exact match, which most senders don't need and which breaks more easily across subdomains and vendors.
A common failure mode: a domain sends through several vendors, each authenticated with its own SPF include or DKIM selector, but the visible From address never matches any of them. DMARC fails for all of that traffic even though every individual vendor's authentication is technically working.
Fixing alignment usually means either using each vendor's dedicated subdomain in the From address, or configuring the vendor to sign DKIM with the sending domain's own selector rather than the vendor's shared one.