After an incident, I have a question which answer's I cannot find. I cannot provide the real headers as they come from a client.
Let’s consider a company which uses an Office365 tenant as mail server. Its domain is example.com, and mail addresses are firstname.lastname@example.org. Employees thus all have a email@example.com account.
The company has published the default Office365 SPF:
v=spf1 include:spf.protection.outlook.com -all
The company does not have either a DKIM published nor a DMARC policy.
Would it be possible to connect with a random Outlook account (firstname.lastname@example.org) to smtp-mail.outlook.com or Outlook.office365.com with protocol SMTP, and then craft an email using email@example.com?
The SPF would pass as the mail is sent from the right servers. The question is more about Microsoft performing access control on emails sent through their SMTP servers.
This question would probably exist for other companies managing mails for you that also host public-accessible emails.