Hi.
I enabled SPF spam check on my zimbra server since long time, following the wiki article.
It always worked great, but lately I get a lot of false positives, like a mail from italian Groupon was marked as spam [agreed that could be legitimate ].

BTW I checked this mail:
[...]
Received: from pop3.mydomain.it [62.149.128.164]
by quaglia.mydomain.it with POP3 (fetchmail-6.3.9-rc2)
for <me@mydomain.it> (single-drop); Fri, 08 Jun 2012 13:10:52 +0200 (CEST)
Received: (qmail 6935 invoked by uid 89); 8 Jun 2012 11:10:04 -0000
Received: from unknown (HELO mxcmd05.ad.aruba.it) (10.10.10.72)
by mxavas2.ad.aruba.it with SMTP; 8 Jun 2012 11:10:04 -0000
Received: from mx27.group.fagms.net ([62.27.57.27])
by mxcmd05.ad.aruba.it with bizsmtp
id KnA41j00D0bEUie01nA4FN; Fri, 08 Jun 2012 13:10:04 +0200
X-CSA-Complaints: whitelist-complaints@eco.de
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=news.groupon.it;
b=jgtXdGGXZRQbOtrMbEc2/noNdrdVVDWdgdcICxVQHfJ5ChtZ0iDAOpw5Ie2BokQiwgV9c+M KTuwTJiJtjvnTJWpyXw3MtSlVf2ACn1wIWSM60j/ql1B9j4STAUteHDZFCCfjNDmuwPO+7+1n3kuzABW0lzHjQBP46 ZZcmAfrw/c=;
h=X-EMID:X-EMMAIL:From:Reply-To:To:Subject:Content-Type:Message-Id:MIME-Versionate;
X-EMID: 0AA030C0KEK1U54VM03R3K101DOBA6D
From: "Groupon" <info@news.groupon.it>
Reply-To: "Groupon" <info-EMID0AA030C0KEK1U54VM03R3K101DOBA6D@news.groupon.i t>
To: me@mydomain.it
Subject: [SPAM]Offerte in famiglia: aria di casa, viaggi e divertimento
So I checked SPF records for news.groupon.it, and the result is:
Code:
Prefix	Type	Value	PrefixDesc	Description
+	ip4	62.27.57.0/24	Pass	Match if IP is in the given range
+	ip4	62.27.38.0/24	Pass	Match if IP is in the given range
-	all		Fail	Always matches. It goes at the end of your record.
but the first row matches the first Received line! So why is the mail marked SPF_FAIL?
X-Spam-Status: Yes, score=10.152 tagged_above=-10 required=5
tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, LOTS_OF_MONEY=0.001,
RCVD_IN_BL_SPAMCOP_NET=1.347, RDNS_NONE=0.793, SPF_FAIL=10,
T_FRT_POSSIBLE=0.01] autolearn=no
I know I can lower the value of SPF_FAIL, but honestly I'd like to understand WHY it fails.

I'm using Zimbra 7.1.4 on Ubuntu 10.04, using libmail-spf-query-perl 1:1.999.1-3.
Thanks!