Two practical things for your immediate problem.
Test properly rather than by sending to yourself. There are free services where you send one message to a generated address and get back a report: whether each of the three records passed, what your content scored, and whether the sending address is on any blocklist. That takes five minutes and it will tell you exactly which of your two configured records is wrong, which is the question you actually have.
Sending to your own account tells you very little, because your provider knows you.
Then check the reports. Once DMARC is set, you receive summaries of who is sending as your domain and whether it authenticated. That is the only place you will discover that the receipts go through a service you configured properly and the password resets go out through the application server directly, unsigned: which is an extremely common split and produces exactly your symptom of some mail arriving and some not.
On volume: a dozen a day is small, and small senders are held to a stricter standard because there is not enough traffic to build much reputation. That is a reason to get the records exactly right rather than a reason to despair: with all three correct and a separate transactional subdomain, low volume is not a problem.