Receive spoofed email

My information may be out-of-date, but might perhaps give you some input. I left the on-premises Exchange world several yeas ago, except for configuring hybrid Exchange environments. At that time you needed 3rd party modules on the Edge servers to handle DKIM and DMARC for outbound mail. There were no modules for verifying incoming mail with either DKIM or DMARC (DKIM is by the way a DMARC requirement).

So out-of-the-box you should have no better spoofing protection.

As to check for SPF, you must enable and configure Sender ID within Exchange 2013 or 2016. Do the following:

$env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1
Set-SenderIDConfig -SpoofedDomainAction Reject
Restart-Service –name MSExchangeTransport

For more information, see https://knowledge.broadcom.com/external/article/178825/how-to-enable-sender-id-filtering-for-ex.html

For extremely useful articles on SPF, DKIM and DMAC with on-premises Exchange, see SENDERID, SPF, DKIM AND DMARC IN EXCHANGE 2016 – PART III. There are links back to the two earlier blogs. Jaap Wesselius is one of the word's leading Exchange experts (I have learned a lot from him through all those years).
https://jaapwesselius.com/2016/08/23/senderid-spf-dkim-and-dmarc-in-exchange-2016-part-iii/

If I may come with a personal recommendation: Use Exchange Online Protection (EOP) as your SMTP gateway, preferably add Office 365 Advanced Threat Protection (ATP). There you have it all. Easy to set up SPF, DKIM and DMARC. Protection against dangerous links and attachments, spoofing, impersonation, zero-day threats. All the security based on AI and machine learning.

The easiest way would likely be to set up connectors between Edge and EOP. This works either your Edge server is set up with a subscription or not. One benefit of subscribing is that you can configure a hybrid Exchange environment from your Edge server.

Hi Amir,
Based on my knowledge, all the incoming mails will be checked by SPF records. It is a by design behavior.
If you have verified that your SPF format is correct, please make sure that the enforcement rules in SPF are set to "-" hard fail, the receiving server's configured spam policy for this type of message.. If it is "~" soft fail or "?" neutral, you may receive mail even after SPF check fails.
The "P" in the DMARC format represents the policy of the organization domain. Please set this attribute to "p=reject". This will reject all emails that cannot pass DMARC detection.
For more information you could refer to: How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing, Use DMARC to validate email and DKIM/SPF/DMARC Verification and Authentication in Exchange Server.
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

How did you test this? It doesn't sound like a valid way to do this.

Post the headers of that test message you sent ( the complete headers with any personal information removed)

I found the problem. SPF and DMARK were ok and senderID was enabled. but when were testing with -sendmessage command from Gmail source we received the spoofed email. so checked agin senderID and other settings on exchage servers. I saw in content filtering role gmail.com has been bypass. so removed gmail.com from bypass list and test again. the problem was solved.
Thanks all.