A valid signature can use the wrong domain
DKIM pass means the message signature validated against the public key for the d= domain. DMARC asks an additional question: does that signing domain align with the visible From domain? A platform signature such as d=vendor.example can pass DKIM but fail DMARC for mail From yourcompany.com.
Relaxed alignment allows a matching organizational domain. Strict alignment requires an exact match, including subdomains.
Confirm the mismatch
In the raw header, locate dkim=pass header.d= and compare it with header.from. Also review the DKIM-Signature d= value. If the provider signs only with its shared domain, enable its custom DKIM or domain-authentication feature.
Do not replace a working provider key with a self-created key unless the provider explicitly supports it. The service needs the private key that corresponds to the DNS public key.
Enable aligned DKIM
Publish the TXT or CNAME records supplied by the platform, complete verification, and turn on signing if that is a separate step. Then send a fresh test and confirm that header.d aligns with the From domain and DMARC passes.