I'm not an email expert by any stretch, so please forgive my lack of correct terminology.
My understanding of SPF is that mail servers that receive mail will look at the return-path domain, and check to see if the server that sent that mail was authorized to by checking SPF records in DNS. But how does this work with "cloud email" solutions, like Office 365?
For example, my domain uses Office 365 Exchange Online for email. For SPF, we have the record
v=spf1 include:spf.protection.outlook.com -all. Does this authorize any Office 365 user, even those outside my domain, to submit mail with return-path as a user in my domain, to their Office 365 mail server and have it pass SPF? After all, I've authorized all protection.outlook.com servers as valid senders, right? Or does Office 365 use some other authentication mechanism to prevent this kind of spoofing?
The specific issue I am trying to troubleshoot is that one of my users received an email that we suspect is spam, and that appears to be coming from one of their contacts. When I look at the email headers, I see that SPF passed, and the return-path matches the "from" in the email, as the actual contact's email address. The contact is using Office 365 for email, and SPF for their domain authorized all proptection.outlook.com servers as valid senders. What does this mean? Does this mean that their email account was compromised? Or could the return-path still be spoofed and pass SPF on Office 365?