Agreed, most spam has valid DMARC - whether that's bigmail.com or just nobodcarestoprotectsubdomains.randompwnedcompany.com