Short answer: For SPF, add the TXT record v=spf1 include:spf.protection.outlook.com -all. For DKIM, publish the two CNAME records (selector1._domainkey and selector2._domainkey) shown in the Microsoft Defender portal under Email authentication settings → DKIM, then enable signing. Finally, turn on DMARC with a _dmarc TXT record.
Microsoft 365 SPF record
| Type | Host / Name | Value |
|---|---|---|
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all |
Microsoft's own documentation recommends -all. If anything besides Microsoft 365 sends mail for your domain (on-premises Exchange, a scanner/printer, a CRM), add it to the record first, or those messages will be rejected. For multiple sources, use the SPF record generator.
Microsoft 365 DKIM setup
By default, Microsoft 365 signs mail with your onmicrosoft.com domain. To sign with your own domain (needed for DMARC alignment):
- In security.microsoft.com, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
- Select your domain. The panel shows the two CNAME records you need to add:
| Type | Host / Name | Value |
|---|---|---|
| CNAME | selector1._domainkey | (selector1 target shown in the portal) |
| CNAME | selector2._domainkey | (selector2 target shown in the portal) |
- Copy the target values from the portal exactly. Microsoft has changed the target format over time: older domains show targets ending in
...onmicrosoft.com, newer ones targets ending in...dkim.mail.microsoft. Use the value in your own portal, not an example from elsewhere. - Once the records have propagated, turn on Sign messages for this domain with DKIM signatures on the same screen.
There are two selectors because of key rotation: Microsoft rotates one while the other is active. You need to add both records.
MX record and spam filtering
In Microsoft 365 the MX record looks like yourdomain-com.mail.protection.outlook.com (or ...mx.microsoft on newer, DNSSEC-enabled setups). You can confirm it with the MX record lookup.
Microsoft 365's built-in filtering (Exchange Online Protection) provides baseline protection. If you want an extra layer or a central quarantine, you can put an email security gateway in front of it: the MX points to the gateway, and Microsoft 365 gets an inbound connector. Enable Enhanced Filtering for Connectors so Microsoft still evaluates SPF against the original sending IP.
DMARC record for Microsoft 365
DMARC is added directly in DNS, independent of your mail provider. Once SPF and DKIM work, start with this record:
| Type | Host / Name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
p=nonefor 1-2 weeks: the aggregate reports show every source sending mail as your domain. If anything besides Microsoft 365 sends for you (invoicing, CRM, newsletter tool), add it to SPF/DKIM too.p=quarantine: mail that fails authentication goes to the recipient's spam folder.p=reject: mail that fails is refused outright. This is the strongest protection against spoofing of your domain.
Use a dedicated mailbox for the report address (rua); reports are XML files and arrive frequently. Gmail, Yahoo and Microsoft all require at least p=none from bulk senders.
How to verify the setup
- Enter your domain in the SPF, DKIM, DMARC checker and make sure all three records show green.
- Send a test message to a Gmail address, open it and choose ⋮ → Show original. You should see
PASSfor SPF, DKIM and DMARC. - Paste the headers into the email header analyzer to read the details in a friendly format.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
I get 'CNAME record not found' when enabling DKIM in Microsoft 365.
Wait for propagation, make sure you entered the host name without repeating your domain (selector1._domainkey), and check that your DNS host didn't append an extra dot or your domain to the CNAME target.
My DMARC reports show onmicrosoft.com. Is that a problem?
It means DKIM isn't yet enabled for your own domain. Complete the DKIM steps above.