Does the script send through a Postfix user or use PHP as the mailer? If it sends it out directly then nothing you set up in Postfix is used. With some forms they used to give an option to send authenticated email through a user account. I think that’s what you want?
Strange thing is when i test using smtp i get 10/10 score and the issue is happening only when i use php mail function. I am using smtp to send via php mail function.
No. This is not strange. As I said above, your PHP mail function doesn’t have SPF or DKIM. It only gets these when set up like in Postfix. Look for a script that doesn’t use the PHP mail function but sends through a user account set up in Postfix. PHP doesn’t magically get the settings from Postfix. They are two independent things.
use an SMTP plugin -if available- for website, or use smtp settings with authentication in php.
without smtp settings, php sends unauthenticated (=spam)