MS 365 Hybrid Deployment – On Premise Antispam Integration

Are you sure mail flow is going directly from your Hybrid server to O365?

When you ran the hybrid wizard it should have created connectors locally and in O365, which will tread mail flow between the forests as internal mail. This means it will bypass the EOP/Spam checks and you should never see those SPF messages.

If your edge device is modifying the headers this may be causing your issue - between your server and O365 nothing should modify the message headers. Make sure you don't have an existing connector that may be overriding the ones created by the Hybrid wizard. You can always delete the existing connectors that were created and re-run the wizard to re-create them.

Check your transport rules in Exchange and make sure they are not modifying the message before going to O365, if they are disable them and test again to make sure those are not your problem.

Last (or maybe first) check that your federation is configured correctly. If it's not that could be why your mail is not treated correctly. This is where re-running the Hybrid wizard can you help you as well.

That's a lot going on there.

1. To aid you in future searches, you may find using the term "co-existence" a bit more helpful for mix version Exchange deployments. I would also start by reviewing the Exchange Deployment Assitant guides here: https://technet.microsoft.com/en-us/exdeploy2013/Checklist.aspx

2. What you are doing is essentially upgrading Exchange environment to 2013. You need to be sure you setup the interfaces and load up the certificates just like you would if you added a 2010 server to your farm. Be particularly mindful of -- Autodiscover internal URI settings (this is the URL registered to the SCP so internal Outlook clients are directed correctly).

3. You should run the Hybrid wizard if you want to use the 2013 server as the Hybrid server. That will update the connectors so mail between on-prem mailboxes and O365 flow thru that server.

4. As far as which servers send "out" messages that is defined by your connectors. 2013 running both CAS/MBX roles has all the transport services running on them. If you are phasing out your 2010 server you want to be sure to create the proper connectors on the 2013 server. And if mailboxes will remain on-prem then you should migrate those to the 2013 server.

Make sure DNS is configured correctly for the server, and if you are going to use it as Hybrid server, use the connectivity analyzer to validate external settings.