Please add a reference note to indicate that when configuring M365 Mailflow that SPF/DKIM still needs to be configured on the Microsoft tenant and possibly reference how to achieve this for inexperienced admins.
https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=Sophos-Mailflow
