Recently (last few months) I have seen increased numbers of emails showing Microsoft 365 as the source, when these emails have originated from another source, e.g. mailgun, taguchi, sendgrid, mimecast (when used for bulk emails), etc., and the mail from and selector matching the original email source.
In the past I have just put this down to misconfigurations of Microsoft 365 at receivers sites and ignored them but the number recently has increased significantly, and for domains with a quarantine or reject policy these emails are often being blocked.
Since the DKIM signature seems to match another source, this is likely that Microsoft here is acting as a relay, which is most often the case when it forwards emails it receives from the original source.
Another reason could be that you are noticing this data now because it wasn’t there previously. I am seeing a lot of data reported by Microsoft, who only start reporting again back in April of 2023.
Without seeing more information and the account in question, it would be difficult to analyze. What I would suggest is to contact dmarcian support at support@dmarcian.com so that your account can be reviewed. They will be able to determine if some adjustment to our rules engine is necessary, or if there is another reason to explain the change in data trends you are seeing.
I also suspect that Microsoft is acting as a relay, and if so then these emails are probably better categorised as Forwards. I will email support so they can check the details and potentially adjust the rules engine.
