A message can pass SPF and DKIM and still fail DMARC

SPF passes. DKIM passes. DMARC fails. That combination reads like a contradiction, and it is not one, because DMARC is not asking the question the other two answer. SPF authenticates the envelope iden