Internal Mailserver/Exchange,
Outbound Mail out goes through SmartHost of the Provider .... all perfect, DKIM runs.

Inbound Mail comes with SmartPop / PopCon and is delivered to the Exchange.
Since the POP to SMTP is the Sender, all Mails have SPF-SoftFail.

Is there a way to handle this scenario?
For me it's a show-stopper and worth a feature request.

All the emails from POP Connector should be sent from a specific IP address, you can add that IP address to trustedIPAddresses settings.

Thanks for the quick answer, now the mails do not soft-fail anymore.
But this can not be the solution, since all the mails now come from a trusted sender, spf-filtering does not "work" anymore.

I had hoped for a better solution, like going back 1 or 2 steps in the "Received:" history to check if there is a spf-designated smtp-server.
Or give a mechanism to specify the "external-receiving-mailserver" and then to check if this server has received the mail from a spf-designated smtp-server.

could you do a test like this, remove POP IP from trustedIPAddresses, enable Full debug log, use Pop Connector to retrieve an email, send the inbound log in dkim installation path\log folder to support@emailarchitect.net, i will think over a solution for you. Please change log level back to only error and add the IP to trusted IP addresses again.