Short answer: inspect the delivered message's From, SPF, and DKIM domains; the aligned SPF or DKIM identity, not a green DNS console, explains why mail is going to spam. The decisive trade-off is between declaring authentication success and proving that the visible From domain is aligned with the authenticated identity. In a marketplace where each seller can point a custom domain at the product, SPF, DKIM, and DMARC can all return green while messages still land in spam. The practical answer...