

Thanks for the insight.
The context is this: I want to send an email to a senator who has no PGP key, and I do not want Microsoft to see it. The msg would go to the email firewall for sure, but from there AFAIK I have no way of knowing what the email firewall does with it. So as you say, the DNS record only indicates that the recipient’s response /can/ go from MS’s server, not that it necessarily will. And indeed there are other “include:” elements on that spf line. But in the end, I suppose I must conclude that the email firewall very likely hands the msg to MS, because if they had taken care to ensure they can send msgs via MS, they likely receive traffic that way too. And so I should not use email to reach the senator.







yup, that’s indeed what I do generally, in the end. I always start with an MX lookup and DNS TXT lookup just to see if the email infra looks safe enough, and compatible with my msg. I often find the answer is trivially /no/, because usually the MX server is simply
*outlook*. But these email firewalls create a bit of opacity so I wanted some clarity on that.Worth noting that MS has been caught snooping on msgs that traverse their network when the msg is about Microsoft (even when MS Corp is not themselves the sender or recipient).