i found a solution to this issue if anyone is interested. the customer’s IT department had the spf record originally using the ip4 type with the ip of the on-site zimbra server when we started this project. at some point after we had concluded our testing of migrating mailboxes from zimbra to office 365, they had changed their spf record to use the mx type only. we had found information that certainly libraries will fail the spf check when relied on the mx type alone and that was the observed behavior we found after having setup an entire testing environment with a zimbra server and an office 365 tenant that both had the host domain setup in both and recreated the issue with messages going to spam from the zimbra server. we tested all the iterations of the spf record we could think of and thats when we found and verified that exchange online protection would send mail to the junk folder if the mx type was the sole type used. we observed that when using the ip4 type for the spf record to have both the zimbra and office 365 tenant, with its required include type, that the legitimate mail sent to other office 365 users was going directly to junk mail.
