SPF pass is not the same as SPF alignment
SPF authenticates the envelope sender, often shown as Return-Path. DMARC compares that authenticated domain with the domain in the visible From header. A third-party platform can therefore pass SPF for its own bounce domain while DMARC reports SPF alignment failure for your brand domain.
Under relaxed alignment, the organizational domains must match. Under strict alignment, the domains must match exactly.
Read the evidence in the header
Find smtp.mailfrom in Authentication-Results or inspect Return-Path. Compare it with header.from. If they differ, configure a custom return-path, bounce domain, or MAIL FROM domain in the sending platform.
DMARC can still pass through aligned DKIM even when SPF is not aligned. Check header.d and the DKIM signing result before assuming both methods are broken.
Repair the sending platform
Add the provider's DNS records for a custom return-path and wait for its verification screen to confirm them. Send a new message, because old headers do not change when DNS changes. The final Authentication-Results should show dmarc=pass and identify an aligned SPF or DKIM path.