MicrosoftAgain, your terminology is inaccurate, making the filters inaccurate. SPF/DKIM/DMARC are anti-spoofing technologies which are SPAM mechanisms and have nothing to do with PHISHING. PHISHING is an intent, and blanket categorizing these emails with no SPF that have a hyperlink in them that isn't a "Safe Link" DOES NOT make them Phishing emails alone. They are SPAM. They may be high confidence spam, but they're still SPAM. There's far more to it.... The mere fact that these "High Confidence Phishing" email rules are located in Anti-Spam filters instead of the actual Anti-Phishing filters in EOP are a testament to them being miscategorized and in the wrong place. It's a poorly conceived notion. Simply put, it's 100% incorrect.
It's just a design flaw that's not getting properly addressed.
