M365 Anti-Phishing/Impersonation - DKIM/SPF/Compauth checks with allowed domains

Question

If I configured a domain in the Anti-Phishing/Impersonation/Add Trusted Senders and Domains will Microsoft set the authentication headers to a fail if the trusted domain fails DKIM/SPF/COMPAUTH? Or will also bypass those checks when the domain is in the trusted list for impersonation? I want to allow a domain to bypass impersonation protection but I also want to make sure that is someone is impersonating that domain or otherwise fails authentication checks it will not continue to be allowed to impersonate a user from our domain.