What SPF, DKIM and DMARC do not fix: authentication vs IP reputation
You set up all three records, the checks all pass, and mail still lands in spam or bounces outright. Nothing is misconfigured. You have simply completed one half of deliverability and mistaken it for the whole: authentication answers who sent the mail, reputation answers whether anyone wants it, and receivers require both. Here is what each protocol actually proves, and why the other half lives in the address.
What the three records actually prove
The trio is an identity system, and each piece proves one narrow thing. SPF is a DNS record listing which addresses may send mail for your domain, so a receiver can check the connection against the list. DKIM signs each message with a private key whose public half you publish in your DNS, so a receiver can verify the content left your infrastructure unaltered. DMARC ties the two to the address the human sees, tells receivers what to do when checks fail, and sends you reports about who is sending as you. Together they prove the mail is really from your domain and arrived intact. That is all they prove, and it is genuinely valuable: without them you fail modern receivers' entry requirements before anything else is considered.
Why spammers pass these checks too
Authentication verifies identity without judging it, so a spammer with a fresh domain and five minutes of DNS work passes all three checks, and routinely does. Passing tells the receiver "this mail is really from whoever this is", which for an unknown sender moves nothing. The checks exist to stop impersonation, phishing sent as your bank, not to certify goodness, and receivers treat them accordingly: as a gate you must clear, not a score you can bank.
The half that lives in the address
The judgement half keys on the sending address and its surroundings, none of which your SPF, DKIM or DMARC records touch. Whether the address or its block sits on blocklists, what its reverse DNS says and whether it matches, the mailbox providers' own memory of the address's sending behaviour, and the history the range carried before you: a transferred or leased block arrives with its past intact, and on a shared address the neighbours write to the same account. Perfect authentication on a burned address is a verified signature on a letter from a bad neighbourhood, and receivers read the postmark first.
How receivers weigh the two together
The practical logic at a large receiver runs roughly: unauthenticated mail from an unknown source is rejected or junked at the door; authenticated mail is then judged on the reputation of its sending address and domain, built from history. Authentication failures cap you at the floor, but authentication successes do not lift you above your reputation. That asymmetry explains the two commonest support tickets in email: "everything passes and we still go to spam", which is a reputation problem wearing an authentication costume, and "we changed nothing and delivery collapsed", which is usually the address's standing changing underneath an unchanged configuration, a question history answers.
The order of operations that works
Both halves are necessary and neither is sufficient, so do them in the order that compounds. Before sending from a range, read what the address and its block have been, because no ramp fixes a block that needed remediation first. Set the identity completely: SPF, DKIM, DMARC and matching reverse DNS, one coherent story about who is sending. Then build the reputation the only way it builds, with consistent volume and wanted mail, and watch both halves over time, your DMARC reports for identity abuse, and the address's public record for the standing your behaviour is writing. Authentication is finished in an afternoon and reputation never is, which is precisely why the afternoon's work gets mistaken for the job.
Look up your sending addresses on the front page to read the half your DNS records cannot show: what the address and its block have been flagged as, with dates and sources, and what a receiver's reputation systems have had the chance to remember.