office 365 mail SPF Fail but still delivered

[tsula]

Hello

today i received mail from my organization. i check headers and see that spf failed.

Received-SPF: Fail (protection.outlook.com: domain of mydomain.com does not
designate 67.220.184.98 as permitted sender) receiver=protection.outlook.com;

why spffailed mails normally received? 

i check SPF at mxtoolbox and SPF is correctly configured.

[#2]

Failing SPF will not cause Office 365 to drop a message, at best it will mark it as Junk, but even that wont happen in all scenarios.

[#3]

@tsula I solved the problem by creating two Transport Rules. The first one reads the "Received-SPF" line in the header information and if it says "SPF=Fail" it sends the message to quarantine. The second one reads the "Authentication-Results" line in the header information and if it says "Fail" sends the email to quarantine. Hope this helps.

[#4]

@tsula firstly, this mostly depends on the spam filtering policy you have configured. Secondly, if your user has the sender's address added to their safe senders list, or sender address is in contacts + contacts are trusted, the message would skip spam filtering and be delivered to inbox.

If you provided a sample message header, we might be able to tell you more.

[#5]

Microsoft please explain how this is designed behavior in this day and age?

Sorry, but this is unacceptable!

@RNalivaika This is defunct out of the box! The default HAS to be secure and currently it is NOT.

[#6]

@tsula 

SPF is just one of the measurement for Email security, you may consider DKIM and DMARC as a whole:

Set up SPF to help prevent spoofing - Office 365 | Microsoft Learn