This source is known to forward email
Domains hosted with Microsoft can be configured to use the hosted domain in the envelope address. This allows SPF to apply to DMARC checks.
DKIM can be configured for Office 365. For more information, visit: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide
Some SPF-specific information can be found on the following page: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing?view=o365-worldwide