Hybrid Exchange 2016 - SPF record not aligned

[Pascal Wenders]

We have a Exchange 2016 Hybrid configuration. SPF and DKIM is setup. We use DMARC for monitoring only, not for rejecting. DKIM is 100%, but SPF is only 29%

When spf verification is aligned we see our domain name. But when it is not aligned we see an office365 mail server. Example eur02-am5-obe.outbound.protection.outlook.com.

Our on premise mail servers don't deliver the messages directly to recipients mail server, they are forwarded to office 365 and then delivered to the recipients. 

How can I get an 100% SPF alignment when we send mails from on premise or from office 365.

I hope someone can give me a hint where to look for.

[#2]

@Pascal Wenders

I take it you have listed your on-premises equipment in your SPF record even though you do not plan to send directly from it, and that you have then tested the SPF record with a third party such as Dmarcian?

https://dmarcian.com/spf-survey/

If you are playing around with your DNS records directly, always test with a banked or minor domain before changing the principle records. Set your TTL as short as your provider will permit and monitor propagation with one of the global checkers as well as doing your own digs.

https://www.whatsmydns.net/

If you have to ask a third party to amend your DNS records, it might be worth asking them "what do you think?" Some will be able to help and others will cheerfully publish nonsense.   

[#3]

Hi @Pascal Wenders 

if I understand correctly, you send directly to internet the email from your on premises server if the sender mailbox in onprem (the spf check will pass) and directly to internet from O365 if the mailbox is in the cloud (the spf check will fail).

if this is your scenario, you have to add an include in your spf record with spf.protection.outlook.com 

[#4]

@Pierfish 

No we send everything thru office 365. The mails from our onpremise mailservers deliver them to office 365 when it will be deliver to the recipient.

Selector1 and 2 are defined and for the onpremise servers not.

Is it than necessary to create the dkim records also on the onprem exchange servers