From my experience, Gmail will send to spam everything from a small server that has no SPF (even when DKIM is on and OK -- which is strange because it basically has SPF built-in) and when the sender is not in the address book -- this is pretty enough for massive issues.
Well sure, but DKIM can sign the sender so it can do the SPF work connected with an envelope spoofing filter. Still, my idea was that a spammer who can put a valid DKIM signature won't likely have any problems with SPF.
