It is not unusual to find a number of freemail providers in your DMARC report.
For example, people receiving mail from you at their google address may choose to forward your mail to yahoo, leading yahoo to report those receipts back to you. The report actually includes a clue - saying SPF check passed for gmail.com. If the report did not include that ...
What is the DMARC policy on the virtual domains? If they include aspf=r or aspf=s
then SPF must be based on a domain that is either the same as theirs or related to it (in a subdomain). So although an SPF check can pass, if there's no aligment of domains from DMARCs point of view it's a failure.
However, our weekly DMARC reports from Postmark still show 70% of
messages as not aligned.
I've tried adding that IP explicitly in our SPF records (as
126.96.36.199/24), but it hasn't improved anything.
Since the issue here is alignment, adding IPs to your SPF is not going to solve the issue.
DMARC is there to demand that the domains used in your ...
Should I add an SPF record under mail.mydomain.com subdomain?
Yes you should, it's best practice, and the receiving mx may well have not just DMARC but other milters filtering based on SPF / DKIM.
In theory DMARC makes allowances for comparing an email from a subdomain against the SPF record of the domain (you might want to add 'aspf=r;') but the ...
The email address in the envelope.from (a.k.a. bounce address or return-path or smtp.mailfrom) are set to use the email domain of mail.mydomain.com. If no SPF record is set for mail.mydomain.com, the described error will be returned.
Or: There is no address specified in the envelope.from field, which results in an HELO lookup for the hostname of the sending ...