Skip to content
inboxprobe

Checkers

Generators

Guides

Guides

SPF, DKIM and DMARC for Microsoft 365

Microsoft 365 needs one SPF include, two DKIM CNAMEs and a DMARC record — and DKIM has to be switched on after DNS is in place.

1. SPF

Microsoft 365 only

Type
TXT
Host / name
@
Value
v=spf1 include:spf.protection.outlook.com -all

Microsoft's documentation uses -all; ~all also works with DMARC. Add other senders to the same record. Microsoft's include costs 2 of your 10 lookups at the time of writing.

2. DKIM

Microsoft hosts and rotates the keys for you; your DNS only points to them with two CNAME records. Copy the exact targets from the Defender portal — they include your domain and tenant, and Microsoft changed the format for new domains in 2025, so examples online are often outdated.

Type
CNAME
Host / name
selector1._domainkey
Value
<target shown in the Defender portal>
Type
CNAME
Host / name
selector2._domainkey
Value
<target shown in the Defender portal>
  1. Open the Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
  2. Select your custom domain, copy both CNAME values and publish them.
  3. Once DNS has updated, switch Sign messages for this domain with DKIM signatures to Enabled.

Until you enable it, Microsoft 365 signs with your tenant's onmicrosoft.com domain. That passes DKIM but doesn't align with your domain for DMARC.

3. DMARC

Start here

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:[email protected]

Move to quarantine, then reject, once reports show all your mail passing. The DMARC generator gives you each stage.

MX, for completeness

Microsoft 365 MX records look like yourdomain-com.mail.protection.outlook.com. Domains that turn on Microsoft's DNSSEC-enabled inbound mail get a target ending in mx.microsoft instead. Both are detected here.

Questions

Why are the Microsoft 365 DKIM records CNAMEs?

So Microsoft can rotate your keys without you touching DNS. Receivers follow the CNAME to the TXT record Microsoft publishes.

The Defender portal says the CNAME records don't exist.

DNS changes can take time, and some DNS hosts append your domain to the host name automatically (selector1._domainkey.yourdomain.com.yourdomain.com). Check the record with our DKIM checker, then try enabling again.

Do I need DKIM for the onmicrosoft.com domain?

No. Microsoft signs that domain automatically. Set up DKIM for each custom domain you send from.

Is -all safe with Microsoft 365?

Yes if every sender is listed. If you use other services (newsletters, CRM) add their includes first, or use ~all while you check with DMARC reports.

Sources

Last reviewed: