Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed?
Or are they unsigned and simply spoofed?
As far as I know necurs spam is spoofed and/or sent from infected machines acting as MTAs.
Other bot nets however obtain valid credentials which they then use for sending emails via the respective MTA which might - or might not - are DKIM signed and/or SPF controlled.
Required, but never shown