adkim and aspf select the mode, both defaulting to relaxed (r). With relaxed alignment mail.example.com aligns with example.com; with strict (s) only identical domains align. RFC 9989 determines the organizational domain with a DNS tree walk instead of the Public Suffix List.
The common failure is third-party senders: a newsletter platform that signs with its own d= and uses its own bounce domain passes SPF and DKIM yet fails DMARC because neither aligns with your From. The fix is a custom DKIM key for your domain (often delegated by CNAME) or a custom return-path subdomain. Only one aligned pass is needed, and DKIM survives forwarding better than SPF.