I used a VM at Linode and Vultr to spoof emails to O365 and Proof-Point as my manager at the former company to remind them to fix the settings in O365 and Proof

I used a VM at Linode and Vultr to spoof emails to O365 and Proof-Point as my manager at the former company to remind them to fix the settings in O365 and Proof-Point. Their default settings are very relaxed and I was never flagged so if your friends are getting spam-boxed or bounced, it's based on the admin settings for their org and SPF ~ vs -. They did fix the settings and they now properly label emails as spoofed but not spam-boxed. O365 spam settings can get sticky and confusing really fast especially if you add many work-arounds for broken things.