Hacker News Reader

That doesn't sound right. Aren't these @zendesk.com addresses?

No, it's spoofed appleid@id.apple.com addresses. But you are correct that it's not customer SPF/DMARC configuration that's the problem.

The spoofed addresses were support@company.com, is my understanding.

Zendesk is very well aware of SPF/DMARC, from their support pages.

The spoofed address was appleid@id.apple.com . support+id@company.com was the to address, not the from address.