DMARC aggregated report SPF domain field

DMARC aggregated report SPF domain field

I am trying to identify, why some of my e-mails are being marked as spam by recipients, and have therefore set up SPF and DKIM. In order to check that they can be verified, I set up aggregated DMARC reports.

When looking at one report, I can see the following:

<record>
    <row>
         <source_ip>x.x.x.x</source_ip>
         <count>1</count>
         <policy_evaluated>
             <disposition>none</disposition>
             <dkim>pass</dkim>
             <spf>fail</spf>
         </policy_evaluated>
    </row>
    <identifiers>
         <header_from>known-domain.com</header_from>
    </identifiers>
    <auth_results>
        <dkim>
            <domain>known-domain.com</domain>
            <selector>selector1</selector>
            <result>pass</result>
        </dkim>
        <spf>
            <domain>completely-unkown-domain.com</domain>
            <result>none</result>
        </spf>
    </auth_results>
</record>

Is there any way to tell, where the domain from the auth_results>spf>domain field comes from? It is unknown to me and not related to any Microsoft Outlook related domains (which is hosting my E-Mails).

Any help identifying the source for the unknown domain would be appreciated.

thanks!