Starting from the Authentication-Results header instead of guessing at DNS saves a lot of time. One case worth adding to Step 2: SPF can pass on its own but DMARC still fails when the envelope sender is the ESP's bounce domain, so alignment is the thing to check, not just pass or fail.