When you configure OpenDMARC to do it's own SPF checks, it always adds spf=pass in Authentication-Results header, no matter if spf check fails. After some time hacking the code I think that the problem is in using variable spf_mode inside switch statement instead of spf_result. Please see the patch for code details:
same as Ticket 120 which already contain a similiar patch
see https://sf.net/p/opendmarc/tickets/120