SPF, DKIM and DMARC for Microsoft 365: step-by-step setup

1. SPF

A TXT record at your DNS provider, host @:

v=spf1 include:spf.protection.outlook.com -all

Microsoft recommends the hard -all, because with only ~all and no DKIM signature the DMARC policy practically does not work. If you also send from other servers, add them to the same record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all. Do not replace include:spf.protection.outlook.com with a list of IP addresses: Microsoft changes them. Every subdomain that sends mail needs its own SPF record.

2. DKIM

1. Open the Microsoft Defender portal: Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM tab.
2. Select the domain and flip the toggle. The portal will show an error with two CNAME values, because the records do not exist yet. Copy them from the section for publishing CNAME records.
3. At your DNS provider add two CNAME records: selector1._domainkey and selector2._domainkey, each with the value given by the portal. For new domains the values end in .dkim.mail.microsoft; always copy them from the portal.
4. After a few minutes (sometimes up to 48 hours) return to the domain details and turn on signing messages with DKIM signatures.

The most common errors according to Microsoft:

• A TXT record instead of CNAME, or the second selector missing.
• The DNS panel appends the domain name to the host and you end up with selector1._domainkey.yourcompany.com.yourcompany.com. Enter only selector1._domainkey in the host field.
• Domain on Cloudflare: the CNAME records must have the proxy turned off (grey cloud, "DNS only"), otherwise validation will not pass.
• The default key length is 1024 bits. Changing to 2048 is done by rotating the key (a button in the portal or PowerShell); rotation takes 4 days.

3. DMARC

A TXT record at your DNS provider, host _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected]

Microsoft describes the rollout: p=none while monitoring reports, then quarantine gradually, finally reject, starting with low-traffic subdomains. It is best to point the report address at a shared mailbox or a group, not a personal one. Details: DMARC guide.

Check the result

Check SPF and DMARC with our tools, or run the full audit below. The full audit recognizes Microsoft 365 by the MX records and checks the selector1 and selector2 selectors.

Source: Microsoft Defender for Office 365 documentation (SPF, DKIM and DMARC setup, pages from July and August 2026): DKIM, SPF, DMARC. Menu item names may change.