They're going to find it progressively harder to get their mail delivered
without SPF or DKIM signing, plus DMARC.
I'd look to the X-OriginatorOrg: header to give you some more insight.
Honestly, the data in any header that includes the word, "Tenant" may (or may
*NOT*!) be referring to what you
Trying to identify mail coming from our beloved corporate overlords,
because of course they can't be bothered to set up SPF or DKIM, because
reasons.
Looking at a couple of messages, they both have a couple of entries:
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-i
This is outside the scope of the mailop list, as I understand it.
mailop is for discussion relevant to those operating a mailserver. Spam
filtering as it applies to mail operations is a bit of a grey area; discussion
of new (or old) spam filtering approaches isn't.
More generally, I think that
Marc Perkel wrote:
>
> Rather that just scan for regex strings it's useful to have a way to tell what
> things the message is talking about and reduce those to a single token that
> represents a concept. Then the concepts can be combined to produce rules or
> fed into Bayes for automatic scoring.
