After an incident, I have a question which answer's I cannot find. I cannot provide the real headers as they come from a client.
The company has published the default Office365 SPF:
v=spf1 include:spf.protection.outlook.com -all
The company does not have either a DKIM published nor a DMARC policy.
Would it be possible to connect with a random Outlook account ([email protected]) to smtp-mail.outlook.com or Outlook.office365.com with protocol SMTP, and then craft an email using [email protected]?
The SPF would pass as the mail is sent from the right servers. The question is more about Microsoft performing access control on emails sent through their SMTP servers.
This question would probably exist for other companies managing mails for you that also host public-accessible emails.