These e-mails are all real and also sent by addresses like [email protected] with the source SMTP server being in a subdomain of PROD.OUTLOOK.COM.

How comes that Microsoft would not just whitelist their own domains on their own e-mail service?