DKIM, DMARC records, etc verify that the email sender is associated with the domain it’s claiming to originate from. It doesn’t mean the email is not spam. Anyone can sign up for a Gmail account and start sending DKIM signed spam from Google’s servers. Obviously it would get shut down pretty quick but my point is that DKIM signing does not mean a message isn’t spam