vanilla installs of 8.0.2. on both CentOS (unsupported) and Ubuntu (supported).
Although there is lots of google history showing that SPF has to be installed/enabled in SpamAssassin, I believe that was for the older versions of Zimbra, and that recent versions have SPF checking enabled by default.
We were first alerted to SPF not working correctly when we received a load of spam from "ourselves" ;-)
Having looked into it further, we *never* see any SPF_FAIL or SPF_PASS tests in the X-Spam headers.
I have spent all day looking into this and can see that SPF is installed:
Feb 20 17:36:22 zimbra-2 amavis: Module Mail::SPF 2.008
Feb 20 17:36:22 zimbra-2 amavis: SA dbg: config: read file /opt/zimbra/conf/spamassassin/25_spf.cf
Feb 20 17:36:22 zimbra-2 amavis: SA dbg: config: read file /opt/zimbra/conf/spamassassin/60_whitelist_spf.cf
Its a vanilla ZCS install with no options changed, so AntiSpam (SpamAssassin) is enabled in the admin UI.
Nothing fancy on the networking side either, its a VM running on a single interface with internet IP. Its not being proxied to or anything. Its MTA trusted networks is default ie itself (via 127.0.0.0/8 and its own IP address).
I don't know why but just cannot see any evidence of SPF checking being made. Ideas ?