What does that mean? I see this on a host that uses trendmicro as an email firewall. I suspect it means that the organisation is using MS Outlook as their email provider behind the email firewall, correct?
It means they want to send email via Exchange Online and have configured their SPF record accordingly -> recipients email services check DNS SPF record for the domain (derp.com or whatever) to see if the sending server is allowed in SPF and handle the incoming message accordingly.
http://www.open-spf.org/SPF_Record_Syntax/
https://en.wikipedia.org/wiki/Sender_Policy_Framework
I’d wager most orgs will just have end users sending email directly via M365 instead of going through an “email firewall” and most larger organisations will probably send email from multiple domains, networks and servers, the SPF record does not tell us which what the actual sending infrastructure is, it just tells us where that domain wants to send email from.
Thanks for the insight.
The context is this: I want to send an email to a senator who has no PGP key, and I do not want Microsoft to see it. The msg would go to the email firewall for sure, but from there AFAIK I have no way of knowing what the email firewall does with it. So as you say, the DNS record only indicates that the recipient’s response /can/ go from MS’s server, not that it necessarily will. And indeed there are other “include:” elements on that spf line. But in the end, I suppose I must conclude that the email firewall very likely hands the msg to MS, because if they had taken care to ensure they can send msgs via MS, they likely receive traffic that way too. And so I should not use email to reach the senator.
Can you mail them a paper letter?
yup, that’s indeed what I do generally, in the end. I always start with an MX lookup and DNS TXT lookup just to see if the email infra looks safe enough, and compatible with my msg. I often find the answer is trivially /no/, because usually the MX server is simply
*outlook*. But these email firewalls create a bit of opacity so I wanted some clarity on that.Worth noting that MS has been caught snooping on msgs that traverse their network when the msg is about Microsoft (even when MS Corp is not themselves the sender or recipient).
