After enabling SPF check in Office 365, SPF checking on incoming mails from HES to Office 365 fails.
SPF is used to verify if the IP address that is trying to send mails on behalf of a domain, which is allowed by that domain.
For HES users who use Office 365, HES is between the sender and Office 365. The incoming mails routes from HES to Office 365 and the sending IP of the original email will change to the HES IP. This causes SPF checking to fail in Office 365.
It is recommended that HES users with Office 365 do not use the Office 365 SPF configuration (which is disabled by default). Admistrators can turn on SPF checking in HES instead.