DMARC fails even though SPF and DKIM pass: how alignment actually works

You open the headers of a rejected or quarantined message and see something like this: spf=pass...