Postfix, forwarding and SPF - gmail

Question

Ive been implementing a forwarding agent with dovecot+postfix, everything goes fine, public IP is AAA.AAA.AAA.AAA
xxxxxx.com.ar has this SPF record
"v=spf1 mx AAA.AAA.AAA.AAA -all"
MX points to same AAA.AAA.AAA.AAA IP, but google (i also receive a lot less but same reports from Zoho Mail) is bothering with false? DMARC rejections:
<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
<report_metadata>
<org_name>google.com</org_name>
<email>noreply-dmarc-support#google.com</email>
<extra_contact_info>https://support.google.com/a/answer/2466580</extra_contact_info>
<report_id>733545798811562331</report_id>
<date_range>
<begin>1616544000</begin>
<end>1616630399</end>
</date_range>
</report_metadata>
<policy_published>
<domain>xxxxxx.com.ar</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>reject</p>
<sp>reject</sp>
<pct>100</pct>
</policy_published>
<record>
<row>
<source_ip>AAA.AAA.AAA.AAA</source_ip>
<count>4</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
**<spf>fail</spf>**
</policy_evaluated>
</row>
<identifiers>
<header_from>xxxxxx.com.ar</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>xxxxxx.com.ar</domain>
<result>pass</result>
<selector>default</selector>
</dkim>
<spf>
<domain>mail.minte.com.ar</domain>
<result>pass</result>
</spf>
</auth_results>
</record>
</feedback>
Weirdest thing: look how google reads a valid email from this domain:
any help will be greatly appreciated, im afraid google will end marking AAA.AAA.AAA.AAA as SPAMMER
thanks !!

Answer 1

As Zoho Support Team said, the problem is with SPF alignment.
On analyzing the attached DMARC report, we see that email sent using the source IP "XXX.XXX.XXX.XXX" had passed the SPF & DKIM authentication.
Please be informed that DMARC policy is evaluated based on "SPF authentication & SPF Alignment" or "DKIM authentication & DKIM Alignment".
In the below attached report, we see the SPF Authentication is passed but SPF alignment fails as the From domain "client.com.ar" & Return Path domain "server.com" are different and that's the reason its mentioned as fail.
To know more about DMARC policy,
https://postmarkapp.com/guides/dmarc#how-does-dmarc-work
This is due to postfix aplying SRS, so reply-to is #forwarder-domain.com so breaks SPF alignment with the sender domain.
Seems unsolvable.