The attack works for spoofing email from domains that have DMARC configured with reject policy against receiving servers that validate DMARC and act correctly according to policy. Only requirement is that the domain the attacker is spoofing is using O365.
This is not a UX problem. This is a Microsoft problem.
This is not a UX problem. This is a Microsoft problem.