For some company,they do not have much knowledge about the mail record setting,most of often,they do not set any spf,dkim record,what they have is only A,MX record.

For example,there is a domain,like  aaaa.com,they only have below records:

@   A   11.11.11.11

mail  A   22.22.22.22

@  MX  mail.aaaa.com

If some spammer use the above domain and forged to send mails to xeams,it is easily to INBOX,if the IP is clean(Not in any RBLs). So i think a new filter is needed for such spams. 

If spf none and not from A and MX record's IP(11.11.11.11 and 22.22.22.22),asign socre to it.