IP Address: 2a01:111:f403:c007::2

According to reverse-DNS, this is a host domain utilized by Microsoft 365 (formerly Office 365) to manage and secure outbound email traffic. It acts as a mail transfer agent (MTA) that filters outgoing messages to prevent spam and malicious content. Format: .outbound.protection.outlook.com. However, we've seen actual spoof attempts and SPAM from MS infrastructure so not classing this a confounder.

Differentiating between Office 365, including email protection services, and Azure (public cloud) when diagnosing incidents is challenging because they utilize shared Microsoft-owned IP ranges. Most of this is probably O365/Outlook or Defender protection breaking DKIM and SPF authentication. Disambiguation is a work-in-progress.