@nieldk @GossiTheDog That tells you that the sending domain has the correct entries, it doesn’t check that the receiver does the right thing for invalid emails.
For example, when I was at Microsoft, all of the right DNS entries were configured for the microsoft.com domain, but if I sent myself an email via my own mail server claiming to be from a MS email address (invalid sender according to SPF, invalid DKIM signature) it was still delivered (and Exchange helpfully stripped off all of the SMTP headers that would make it obvious that it came from an invalid sender).