How to Set Up SPF, DKIM & DMARC for Microsoft 365

Henry Timmes Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)

The exact DNS records and portal steps - SPF, DKIM and DMARC done right for Microsoft 365.

What Microsoft 365 Needs

To authenticate mail sent from or through Microsoft 365, you publish three DNS records: an SPF record authorizing Microsoft's servers, DKIM signing enabled in the Microsoft 365 Defender portal, and a DMARC record telling receivers how to handle failures. If you also send through other services (an ESP, a CRM), each one must be included too.

SPF for Microsoft 365

Microsoft 365's SPF include is include:spf.protection.outlook.com. A typical record for a domain that sends only through Microsoft 365 looks like this:

If you send through other services as well, add each provider's include before the -all. Keep to one SPF record, and stay under the 10 DNS-lookup limit.

DKIM for Microsoft 365

Enable DKIM in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → DKIM. Microsoft gives you two CNAME records (selector1 and selector2) to publish in DNS; once they resolve, you switch DKIM signing on for the domain.

DMARC for Microsoft 365

Publish a DMARC record at _dmarc.<domain>. Start at p=none with a reporting address so you can observe before enforcing:

Once every legitimate source aligns, move to p=quarantine and then p=reject. The full path is in the migration guide.

Frequently Asked Questions

What is the SPF record for Microsoft 365?

How do I enable DKIM in Microsoft 365?

What DMARC policy should I start with for Microsoft 365?