Alignment is the only thing that matters

SPF check is on MAIL FROM (envelope/Return-Path). DKIM check is on the d= tag in the signature. DMARC enforces that at least one of those matches the visible From: header domain.

Practical rule: for full DMARC alignment, set:

• Return-Path to a subdomain you control (bounce.example.com) that's authorized in your SPF.
• d= in DKIM signature to your root or organizational domain (example.com).

KumoMTA controls Return-Path via:

kumo.on('smtp_server_message_received', function(msg)
  msg:set_meta('queue', msg:recipient():host())
  msg:set_meta('routing_domain', msg:recipient():host())
  -- Use VERP for bounce attribution
  local vrp = 'bounce+' .. msg:id() .. '@bounce.example.com'
  msg:set_meta('return_path', vrp)
end)

Publish:

example.com         IN TXT "v=spf1 include:_spf.example.com -all"
_spf.example.com    IN TXT "v=spf1 ip4:198.51.100.0/29 -all"
bounce.example.com  IN TXT "v=spf1 ip4:198.51.100.0/29 -all"

example.com         IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; sp=reject;"

Without alignment, you fail DMARC even with passing SPF+DKIM. This is the #1 misconfiguration for new senders.