R2 — Known sender, DKIM fail, alignment OK

Triggers when: a known-sender source shows DKIM failing with no accompanying DKIM alignment problem.

What to do: a DKIM fail from an otherwise-legitimate known sender usually means a signing key was rotated without the old one being fully retired, or the sending platform's DKIM setup for your domain broke recently — check with the sending platform's DKIM/DNS setup for your domain.