You can check against the SPF/SIDF verification results using the following syntax:
if (spf-status == "Pass")
If you want a single condition to check against multiple status verdicts, you can use the following syntax:
if (spf-status == "PermError, TempError")
You can also check the verification results against the HELO, MAIL FROM, and PRA identities using the following syntax:
if (spf-status("pra") == "Fail")
https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_01000.html?bookSearch=true#con_1132105