I'm seeing this stamp when I get email from a particular distribution list. Received-SPF: None (cluster.domain.com: faculty-owner@mail.realdomain.comdoes not designate permitted sender hosts) Now, I know the realdomain.com has a valid SPF record. So where does Exchange pick up cluster.domain.com?

Is it your exchange server? Perhaps its picking up cluster.domain.com as the response to ehlo, or someone changed a server name without updating their SPF record.

Yes it is my exchange server. I have no idea where it is picking up cluster.domain.com, but I do remember when I first set up exchange, there were several places in exchange, where cluster.domain.com had been placed until I changed them to the real domain information.

Well, path of least resistance would be to add cluster.domain.com to SPF record.