In case anyone at microsoft cares, the domain css.one.microsoft.com has two SPF records, which is why their emails are being rejected:
;; ANSWER SECTION: css.one.microsoft.com. 86400 IN TXT "v=spf1 include:_spf-ssg-a.microsoft.com -all" css.one.microsoft.com. 86400 IN TXT "MS=ms50282461" css.one.microsoft.com. 86400 IN TXT "v=spf1 include:outlook.com ~all" css.one.microsoft.com. 86400 IN TXT "v=msv1 t=6097A7EA-53F7-4028-BA76-6869CB284C54" _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop