Good triage order. One thing I would add near the top: check that the From domain and the DKIM signing domain actually align, not just that both pass. A lot of setups pass SPF via the ESP's bounce domain and still fail DMARC because nothing aligns with the visible From. PTR is the one people forget entirely when they self-host.