DMARC failing even though SPF and DKIM both show pass in headers

Sadly I'm stuck on a DMARC issue that makes absolutely no sense when you first look at the headers. SPF is passing. DKIM is passing. Yet DMARC is still failing on a portion of our mail, and it only shows up when you start looking at aggregate reports instead of individual test messages.

After way too much digging, it looks like the problem isn’t authentication at all, it’s alignment. Mail is being sent through a vendor where SPF passes for their bounce domain, and DKIM passes for their signing domain, but the From address is still our domain. So technically everything passes, just not for the same domain, and DMARC doesn’t care how “close” it looks.

What’s making this annoying is that it’s inconsistent. Some messages align fine when they go direct, but fail when routed through another service. Different receivers also seem to evaluate it slightly differently, which makes testing feel unreliable.

Most guides just say “SPF or DKIM needs to pass” and barely mention that alignment is the whole point, so it took longer than it should have to figure out why DMARC was still iffy.

Before I start pushing vendors to change their DKIM signing or set up custom domains everywhere, I’m curious how others usually deal with this in real life. Do you force vendors to align with your domain, or do you loosen DMARC during transitions and accept some noise?