DKIM failure is showing up on some emails. What’s causing it? Need advice

I manage email marketing for a small home decor brand. We're using Klaviyo. A few days ago I noticed some emails landing in spam, especially with Gmail customers. A later placement testing confirmed it.

I checked the authentication with free checkers online and noticed DKIM is passing on some emails but failing on others. SPF seems to pass most of the time. And I'm not even sure what's going on with DMARC. The strange thing is, we haven't intentionally changed our DNS records recently. But we did add a new tool for transactional order emails last month, though. I'm thinking if that could be related but I'm sure we didn't delete anything.

I checked the DKIM settings in Klaviyo and the records look fine, but I'm not confident whether I'm checking the right things.

Also, should the DKIM domain match our From address domain exactly, or is using a subdomain fine?

I'm trying to figure out whether this is a configuration issue or the new tool cuased it, or something else entirely.

How would you troubleshoot this? Is there a reliable way to identify which emails are failing DKIM and why, without manually checking every message?