I recently encountered a similar situation to this. My company uses O365, and I’ve got an application which sends emails to customers. The application just reli

I recently encountered a similar situation to this. My company uses O365, and I’ve got an application which sends emails to customers. The application just relies on postfix to relay through O365. Apparently we hadn’t added the public IP of this server to our SPF records. The results was O365 adds on some headers saying SPF=fail, but sends to the destination anyways. When the destination was gmail, gmail just ignored those headers and added on some SPF=pass headers since the email it received correctly came from O365. I’m guessing this is the lax validation the article is talking about, since I’d expect the receiving server to search for any FAIL headers in the email to reject.