SPF, DKIM and the order they break in
When mail starts landing in spam the cause is almost never exotic. Check alignment first: the domain in the From header has to match what DKIM signed and what SPF authorises, and a forwarder in the middle quietly breaks the second one. DMARC then reports the failure without explaining which of the two it was, which is why reading the raw headers of one rejected message beats a week of guessing.
Written down mostly so I remember it next season.