Three different checks
SPF evaluates whether a sending host is authorised for a relevant SMTP domain. DKIM checks a domain-associated signature over specified message elements. DMARC considers alignment with the visible author domain using supported authentication results and publishes handling policy. These are related checks, not interchangeable labels for a genuine message.
What a pass can miss
A criminal can use an account they have compromised or a lookalike domain they control. That traffic may pass domain authentication. A DKIM signature need not cover every header, so the signed fields and any relevant signing options must be examined. Human attribution requires additional evidence about access, devices, delegation and the circumstances.
What a failure means
Forwarding, message modification, configuration errors and missing historical verification material can affect an assessment. A failed or unavailable result is not automatically proof of fabrication. Preserve the original message, the receiving system's reported results and any verification method used. Record the distinction between a contemporaneous receiver result and a later revalidation. The practical question is what each result supports, what it leaves unresolved, and whether independent material corroborates it.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.