The emails sent from Sunrise are sent from a Sunrise Server, so its important that the merchant has correctly setup the SPF records in their domain.
For example if the merchant is sending emails as info@merchantname.com , the Sunrise server where they are sending the email should be authorized in the DNS settings.
You can find the Sender of the email in Sunrise channel general settings:
Channel contact email and channel email.
For example, you need to contact the Domain hosting provider of the merchant, and ask to add / update their SPF records, something like this:
v=spf1 a mx include:spf.protection.outlook.com include:_spf.sunrisecloud.com -all
Note that the entry in this example include: _spf.sunrisecloud.com includes the complete range of the server IP's where you are running Sunrise.
A good tool to test that the configuration is working well is https://www.mail-tester.com/
It provides you a temporary email that you need to enter in Sunrise when sending the email for example from the order status window.
After you send the email from Server, check the result in https://www.mail-tester.com/
The result gives you a detailed summary of the status, a score and explanation to solve it.