SPF Check not working

Question

Sorry my english is not the best. 
 
 We have setup an SPF-Record for our Domain. SPF-Record Checker reports everything is ok. 
 SPF-Check is activated on UTM. If we get a mail from "copy@mydomain.com" to copy@mydomain.com from an not in SPF registered IP and this mail contains an attachemen, the mail will pass and gets delivered. In this case an docm-file with Locky was delivered to user. 
 
 We have no sandboxing-licence, but i think SPF-Check didnt work in this case or did i make a mistake ?

KylieInvie · Answer

So this is what it turns out was our issue. For some reason in the past before I was hired on here, someone added our domain to the Exceptions tab under a SKIP SPAM list. Being on this list caused any email that was legitimate or not that used our domain to skip and of the spam checks including the SPF check. I removed our domain from this list yesterday and have yet to receive any spam emails that appear to be coming internally. This was the way this has always been set up and had never been an issue before. I believe after one of the recent updates this started occurring. Hopefully the spam stays away this time.