Find the SPF-authenticated domain in trusted Authentication-Results.

Then compare it with the domain in the visible From header.

Example:

From: billing@example.com
Return-Path: bounce@vendor.example
spf=pass smtp.mailfrom=vendor.example

SPF can pass for vendor.example while failing DMARC alignment with example.com.

Check whether aligned DKIM provides the other DMARC pass path. If not, configure the sender for an aligned return path or DKIM identity according to the provider’s supported design.

Reference material