If you want to avoid SPF issues (and more than SPF) you have to rewrite headers.
AFAIK, this can be done by SRS: http://www.open-spf.org/SRS/

Unfortunately, there's no SRS support in Zimbra (it's been a RFE for years).

Check this thread: viewtopic.php?f=15&t=70591

This is not Zimbra, this is Carbonio.
You should post here: https://community.zextras.com/forum/

Looks like the old SPF forwarding issue (and no SRS in Zimbra)...

Zimbra's distribution lists are not "real" distribution lists (I don't know how to explain this). In real DL, subscribers send a mail to the DL, then the DL sends it back to all subscribers with the DL as sender/from. Not the initial sender. This way, there's no such SPF issues as you are ...

Blocking domains (or worse, allowing a few domains only) usually ends up breaking things (delivery tests). I can understand a "fully private" server (non routed domain, not connected to the internet) but not really blocking/allowing domains. However, if you want to do something like this, ...

You can use Zimbra Network Edition and setup the "Archiving and Discovery" feature for that.
https://www.zimbra.com/business-email-c ... discovery/

There's this thread too viewtopic.php?f=13&t=67390

Several hundreds users on several Zimbra servers (multi-server platform) on Proxmox for years.
Primary volumes on Ceph-SSD (hyperconverged servers).
Secondary volumes on NFS.

I have not seen this issue (on any upgraded server).