If you are using ServiceNow relay and a user sends an email to the instance, those emails are audited. Some of them could be marked as SPAM.
If the email is marked as spam, the header of the email contains 'X-ServiceNow-Spam-Status: Yes'.
Your ServiceNow email relay system uses SpamAssassin to determine if an email is a spam by assigning points based on several spam tests.
SPF checks factor heavily into a mail’s spam score. In order to be flagged as spam, a message must have an aggregate score of 6.2 or higher. A soft SPF failure will add 3.5 to the score, whereas a hard SPF failure will add 7.0 to the score, immediately flagging it as spam. It is recommended to check and ensure that your company’s SPF records are correct and up-to-date, or some messages may be inadvertently marked as spam.
The best solution would be for the email domain they are using to update their SPF records. The sender should let their email admin know and that they need to have an up to date SPF record for the domain they are using so that the emails sent from their domain do not fail SPF checks.
More general information about our Email Spam Scoring and Filtering: KB0549426