A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed):

     <record>
        <row>
          <policy_evaluated>
            <disposition>none</disposition> 
            <dkim>pass</dkim> 
            <spf>fail</spf> 
          </policy_evaluated>
        </row>
        <auth_results>
          <dkim>
            <domain>mail-provider.com</domain>
            <result>pass</result>
          </dkim>
          <spf>
            <domain>subdomain.mail-provider.com</domain>
            <result>pass</result>
          </spf>
        </auth_results>
      </record>

I do not understand why evaluated DMARC policy is `fail` with respect to SPF. As `<auth_results>` show, SPF by itself validates. AFAIK, in this case the DMARC failure can be only caused by [passed SPF identity not being identity-aligned according to DMARC policy][1]. But how could it happen in my case?

The DMARC RFC 7489 [reads][2]:

> Identifier Alignment:  When the domain in the RFC5322.From address
>       matches a domain validated by SPF or DKIM (or both), it has
>       Identifier Alignment.

* Domain in the "From:" field is `mycompany.com`.
* SPF record for `mycompany.com` is `include:mail-provider.com`.
* SPF record for `mail-provider.com` contains a range of IP addresses they use to send mail from. The mail has arrived from an address in that range.
* DMARC policy for `mycompany.com` does not require "strict" alignment for SPF.

I thought that the "passed SPF identity" in this case is `mail-provider.com`, for DMARC to pass it needs to align with `subdomain.mail-provider.com`, and it does so in "relaxed" mode. What am I missing?

  [1]: https://security.stackexchange.com/a/171341/50647
  [2]: https://www.rfc-editor.org/rfc/rfc7489#page-8