As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed?
Or are they unsigned and simply spoofed?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As far as I know necurs spam is spoofed and/or sent from infected machines acting as MTAs.
Other bot nets however obtain valid credentials which they then use for sending emails via the respective MTA which might - or might not - are DKIM signed and/or SPF controlled.