You should see a summary in the email header just after the X-Spam-Status one, which explains how it came to this (ham) score.
This should looks something like this, with different scores of course:
X-Spam-Report:
* -0.0 SPF_PASS SPF: sender matches SPF record
* -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
* domain
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
* [score: 0.0000]
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
* trust
* [87.253.236.95 listed in list.dnswl.org]
* 0.0 HTML_MESSAGE BODY: HTML included in message