A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed):

 <record>
    <row>
      <policy_evaluated>
        <disposition>none</disposition> 
        <dkim>pass</dkim> 
        <spf>fail</spf> 
      </policy_evaluated>
    </row>
    <auth_results>
      <dkim>
        <domain>mail-provider.com</domain>
        <result>pass</result>
      </dkim>
      <spf>
        <domain>subdomain.mail-provider.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>

I do not understand why evaluated DMARC policy is fail with respect to SPF. As <auth_results> show, SPF by itself validates. AFAIK, in this case the DMARC failure can be only caused by passed SPF identity not being identity-aligned according to DMARC policy. But how could it happen in my case?

The DMARC RFC 7489 reads:

Identifier Alignment: When the domain in the RFC5322.From address matches a domain validated by SPF or DKIM (or both), it has Identifier Alignment.

• Domain in the "From:" field is mycompany.com.
• SPF record for mycompany.com is include:mail-provider.com.
• SPF record for mail-provider.com contains a range of IP addresses they use to send mail from. The mail has arrived from an address in that range.
• DMARC policy for mycompany.com does not require "strict" alignment for SPF.

I thought that the "passed SPF identity" in this case is mail-provider.com, for DMARC to pass it needs to align with subdomain.mail-provider.com, and it does so in "relaxed" mode. What am I missing?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed):

 <record>
    <row>
      <policy_evaluated>
        <disposition>none</disposition> 
        <dkim>pass</dkim> 
        <spf>fail</spf> 
      </policy_evaluated>
    </row>
    <auth_results>
      <dkim>
        <domain>mail-provider.com</domain>
        <result>pass</result>
      </dkim>
      <spf>
        <domain>subdomain.mail-provider.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>

I do not understand why evaluated DMARC policy is fail with respect to SPF. As <auth_results> show, SPF by itself validates. AFAIK, in this case the DMARC failure can be only caused by passed SPF identity not being identity-aligned according to DMARC policy. But how could it happen in my case?

The DMARC RFC 7489 reads:

Identifier Alignment: When the domain in the RFC5322.From address matches a domain validated by SPF or DKIM (or both), it has Identifier Alignment.

• Domain in the "From:" field is mycompany.com.
• SPF record for mycompany.com is include:mail-provider.com.
• SPF record for mail-provider.com contains a range of IP addresses they use to send mail from. The mail has arrived from an address in that range.
• DMARC policy for mycompany.com does not require "strict" alignment for SPF.

I thought that the "passed SPF identity" in this case is mail-provider.com, for DMARC to pass it needs to align with subdomain.mail-provider.com, and it does so in "relaxed" mode. What am I missing?