Email spam scanning trouble on our domain

Can you explain in more detail what you mean "Spoof internally"?

The point is: If you using a Exchange and User A send a Mail to User B on the same exchange, normally the Mail will not be send to the MTA. Instead the Exchange will deal with internal email traffic. 

Sorry about that. I am getting Emails that say from user@ourdomain.com but in the header it has a true from/reply address of something from a different domain. But since it has our domain it seems to bypass the spam checks. We have an SPF and DKIM/DMARC setup on our domain as well.

Hope that helps

It does not bypass the spam checks. There is no Check for this in XGV17.1. 

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/20494291-advanced-antispam-greylisting-spf-dkim

As far as i know, SPF will be added in the next Major Release (V17.5). 

Maybe you get in touch with your Partner. He can help you to build up a solution with this. Currently i resolve this limitation with Central Email. 

https://www.sophos.com/en-us/medialibrary/pdfs/factsheets/sophos-email-dsna.pdf