DKIM signs outbound mail. Without a matching DNS selector, DMARC often fails even when SPF looks fine.
Custom ESP selectors may not be in the default list — check s= in the header. Also: DMARC, SPF.
s=