We do not use an aggregator. However, after reading this??and this , I can see where there could be a problem even though it's not clear exactly why Valimail finds an issue. I would press them for a thoroughly articulated reason. I would be genuinely interested to hear it.
Separately, I think the short answer may be to simply add GIO to the DNS TXT entry for SPF on your domain by inserting "include:groups.io" before your "~all" or "-all" statement. This may be enough to appease the interrogator at Valimail. I am now thinking we should do the same.
--
Jim
Jim Wilson