Spamassassin wrongly marks mails as spam because of failed DMARC check

[admail]

Since quite some time we noticing mails from domains were wrong SPF / DKIM configuration is unlikely (Dell.com / gmail.com / microsoft.com ) are failing the DMARC check and logical are taggt as spam.
Oddly enough this is not consistent sometimes mails pass without spam tag. We are unable to reproduce the problem. Sending mails from a test domain with correctly configured DKIM and SPF are passing.
We checked via wireshark that the DNS configuration is working. Requests are forwarded to our main DNS server, accept for queriing blocklists. I'm pretty sure that we would notice a DNS-misconfiguration there.

We tried to rerun spamassassin with

spamassassin -t -D < test.eml

but oddly enough this also fails for mails which passed the spam check the first time. So we can't work out differences this way.

I suspect maybe the TrustPath is wrong ( https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustPath) however

adding add_header all RelaysUntrusted _RELAYSUNTRUSTED_

does not work ( see https://forum.proxmox.com/threads/add-header-via-spamassassin-config.121695/ )

Systeminformation:
PMG 8.1
/etc/pmg/templates/local.cf.in is attached

Any hints on how to debugg this further or ideas what logs to check are / actions to take are really welcome. Thanks in advance.

 

[groupm7]

Vendors have many different servers they send email from.
It is possible those messages fail DMARC through SPF, DKIM, or both.

Given that DMARC is the domain managers arbitrarily set options they expect recipient email filters to enforce, they are going to be errors/misflags here and there.

Many smaller business do not have a competent IT/MSP that knows SPF/DKIM/DMARC, larger corporations require 15 levels of approval for changes.

 

[Stoiko Ivanov]

Since quite some time we noticing mails from domains were wrong SPF / DKIM configuration is unlikely (Dell.com / gmail.com / microsoft.com ) are failing the DMARC check and logical are taggt as spam.

please share the complete logs of such a mail - maybe we can see where things go wrong
also share the headers of the mail (for dmarc to pass the headers are also quite relevant)

finally please also share your resolv.conf