Both checks passed and the mail was rejected
Marketing email goes out through a sending provider. The report says the sender-policy check passed, the signature check passed, and the overall verdict failed. That reads like a contradiction until you notice there are three different domains in one message.
The two checks each authenticated a domain belonging to the provider. The domain in the From line — the only one a person ever sees — was authenticated by nothing.
Outside every boundary: The signing domain (also invisible), The From line (the only one they see), Envelope sender (invisible to the reader), an empty slot for the sender-policy check, an empty slot for the signature check, an empty slot for the what the verdict compares against Connections: sender-policy check calls Envelope sender (step 1) signature check calls The signing domain (step 2) what the verdict compares against calls The From line — must match one of them (step 3)