Every piece names its sources. Where we relied on somebody else's estimate, we say it is an estimate.
A lifecycle diagram shows one journey in one tool. The DNS of the same company shows the welcome, the receipt, the support reply and the survey leaving from different systems that do not share an unsubscribe list.
SPF, DKIM and DMARC answer who sent the message. None of them says the connection has to be encrypted. I went to see who bothers with the record that does.
The industry finished the DMARC argument and moved on. What it left behind is a layer of SPF records that were written for a softer world, and one of them belongs to a company that sends a great deal of mail.
Canva sits at nine of a possible ten, and I only know because I wrote a counter that follows the chain the way a receiving server does rather than the way a person reads it.
I expected a mess and did not find one. The interesting results were the two domains that were not clean, and neither failure is the one you would guess.