Read the passing signature’s d= domain and compare it with the visible From domain.

A provider can produce:

From: alerts@example.com
DKIM-Signature: ... d=provider.example; ...
dkim=pass

The signature is cryptographically valid, but its domain may not align with example.com.

Configure custom DKIM signing for the From domain or another aligned domain according to the provider’s capabilities.

Reference material