[winstonwinston]

> Additionally, the DMARC policy for upwork.com is set to "strict" - which means that if the SPF check fails then all RFC-compliant SMTP servers should reject the message.

There is no “strict” policy. DMARC policy can be one of the following p= {none, quarantine, reject}.

The receiver decides if it wants to apply published DMARC policy for unauthenticated mail. What problem are you seeing exactly?

Remember both SPF and DKIM are used for policy evaluation.