Review of email please

Hi all.

I export an email and attached it for review.
This email breezed through SA, and I am having a hard time understand how this can be.


  1.  It fails SPF (I check manually)
  2.  It fails a strict DMARC (I check manually)
  3.  It clearly couldn't pass the default def_welcomelist_auth *@*.fidelity.com<mailto:*@*.fidelity.com>
  4.  IP is from Argentina
  5.  Contains URI containing the recipient's name as well as a '.tr' domain
  6.  Contain verbiage it's a "Microsoft e-Fax" but the sending domain is fidelity.com
  7.  Contains a footer of "Microsoft Corporation, One Microsoft Way"
  8.  Contains a "microsoft-logo" in the footer

I'm sure some subject matter expert may see more flags than these, but shouldn't the first two together provided a score of spam?
I understand at the time it may have not been known to any RBL, including the uri in the body. But if it fails SPF and a strict DMARC did we need any more?
Other than my trained BAYES scoring it fishy and one of the KAM rules matching, this looked like ham to SA, and I just cannot understand why.

My Setup:
SA 4.0.1 (UPDATE version 1922852) on Windows Server with strawberry perl 5.38.2.2-64bit
Trying out KAM rules

If any additional details are required from my end, please let me know and I will provide.


-Max