Legitimate emails from my domain are failing DMARC, what could be the cause?

Legitimate emails from your domain are failing DMARC because the message's alignment with your domain's From: address is broken, even if SPF and DKIM pass individually. DMARC requires either SPF alignment (the domain in the SMTP MAIL FROM and the From: header match) or DKIM alignment (the d= domain in the DKIM signature and the From: header match). A common cause is when your sending script uses a different domain in the From: address than the one used for SPF authentication or the DKIM signature.

For example, your script might be setting the envelope sender (Return-Path) to `bounce@mail.example.com` while the From: header displays `noreply@example.com`. SPF would pass for `mail.example.com`, but the domains `mail.example.com` and `example.com` are not in alignment. Similarly, if your DKIM module is signing with a selector for `server.example.com` but the From: address is `user@example.com`, alignment fails. Check your Postfix configuration and script headers. Use `postconf -n` to see your `myorigin` and `mydomain` settings, and verify the exact domains used in your script's MIME headers versus the SMTP envelope.