Port 25 is the standard server-side email port. This includes server-to-server relaying, etc. It is the standard. You can set postfix to use a different port, but it's unlikely you'd be able to talk to anyone else.
Port 587 is typically what a mail client would use to send mail to a server. In this case, by client, I mean something like an iPhone, or ...
Perform your own message trace from the Security and Compliance center and verify that the email originated from your Office 365 tenant.
Look at the sign-ins logs in Azure AD for suspicious sign-ins.
Look at the Risky users, Risky sign-ins, and Risk detection logs in Azure AD and look for suspicious activity.
Create a Display Name Spoofing transport rule ...
465/587 are client submission ports, they are usually protected with authentication and transport layer security. Email clients, i.e. MUAs, use port 587 and 465, while mail servers, i.e. MTAs, use port 25.
Opportunistic TLS (Wikipedia)
"At least for the email related protocols, RFC 8314 favors separate
SSL ports instead of STARTTLS."
Its very easy to send from any domain within your network if you allow SMTP relay to O365 from your Corp IP range.
It a common security misconfiguration that I look for.
login to your O365 Exchange admin center
Browse to Mail flow > Connectors
Check the connector rules set up, this will show which Public IPs/networks are allowed
Based on the IP(s) you ...
In my situation, for two distinct Ubuntu and Debian servers, the problem was a broken systemd service file for opendkim.
The config files were absolutely ok but the service file was probably generated by an old version.
To regenerate the service file and reslove the problem, just run this command: