==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
1.6.8 MARIADB edition
downloadable installer
Linux
Nginx
IredAdmin-Pro

I have server with cPanel and on this server I forward all account in domain somedomain.com to server with IredAdmin-Pro and domain seconddomain.com. All mail from this domain is in Quarantine and has very low spam score. As I see in maillog, common to all those mail is  SPF_FAIL=5. All  other mails is OK, no false positives or something lika that. I have also add IP of cPAnel server to mynetworks in Postfix and in amavisd.conf.

This is from maillog:

Tests: [DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,HEADER_FROM_DIFFERENT_DOMAINS=0.249,HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001,RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001,RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,SPF_FAIL=5,SPF_HELO_NONE=0.001,T_SCC_BODY_TEXT_LINE=-0.01,URIBL_BLOCKED=0.001], autolearn=no autolearn_force=no, autolearnscore=5.144, dkim_i=@somedomain.com,@medtechmvp.com,sender@sender.com, dkim_sd=default:somedoamin.si,dmsgs:sender.com, 1131 ms (2765434-05) Blocked SPAM, <bounce-1195928-1196618489@sender.com> -> , Hits: 5.145, tag=0, tag2=0, kill=0, L/Y/Y/Y

What else can I do?