These are the full headers. (Sorry, did not realise all emails get redacted)
https://pastebin.com/Z6hkL9hD and the non-forwared mail header too: https://pastebin.com/WGM0aYrh Does not look like SRS (but a good readup, something learned again). I really don't get this. The spf record for 'amazon.de' states : v=spf1 include:amazon.com -all So I understand the SPF fail, since there is no 'amazon.com' to be found here... but the mail server obviously thinks it's valid, which it probably is, at least it is legit and amazon should have correctly configured mail servers - I hope... -- Sent from: http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html