Perform your own message trace from the Security and Compliance center and verify that the email originated from your Office 365 tenant.
Look at the sign-ins logs in Azure AD for suspicious sign-ins.
Look at the Risky users, Risky sign-ins, and Risk detection logs in Azure AD and look for suspicious activity.
Create a Display Name Spoofing transport rule ...
The question is not easy to understand, as noted in the question comments, but it seems the issue is with DNS resolution on the client.
This is most likely due to one of three reasons.
Nameserver entries at your DNS registrar are wrong.
If your client is using a public DNS resolver (e.g. Google, Cloudflare) they will ultimately check the nameservers ...
Can you do that?
Yes you can.
~50% of all visitors that tries to visit your website will either visit SERVER-A or SERVER-B. It is called "Round Robin DNS".
Its very easy to send from any domain within your network if you allow SMTP relay to O365 from your Corp IP range.
It a common security misconfiguration that I look for.
login to your O365 Exchange admin center
Browse to Mail flow > Connectors
Check the connector rules set up, this will show which Public IPs/networks are allowed
Based on the IP(s) you ...
As far as I can tell from here...
This is is your real error:
date time server sshd[pid]: pam_sss(sshd:account): Access denied for user testuser: 4 (System error)
And this is sshd having a guess (and almost certainly guessing wrong):
date time server sshd[pid]: error: PAM: User account has expired for testuser from ip
sshd is calling PAM.
The account ...
Just had the same issue - all domain accounts giving "incorrect password" error, local user account working fine - and a reboot fixed it for me.
I realize this question is several years old, but at least here's a fix that has actually worked for the problem described in this question, at least once!