Microsoft 365: set up SPF, DKIM and DMARC

To authenticate mail sent through Microsoft 365 (Exchange Online), publish three DNS records: an SPF record v=spf1 include:spf.protection.outlook.com -all, two DKIM CNAME records (selector1._domainkey and selector2._domainkey) pointing at your tenant, and a DMARC record at _dmarc starting with v=DMARC1; p=none; rua=mailto:[email protected]. Unlike most providers, Microsoft 365's DKIM uses CNAMEs that reference your onmicrosoft.com tenant, and you must switch DKIM signing on in the portal after publishing them.

Step 1 — SPF

Add a single TXT record at your root domain (host @):

Microsoft recommends the hard-fail -all qualifier. Qualifiers differ by provider — Google's docs, for instance, suggest the softer ~all — so don't be confused if you are setting up both. Publish only one SPF record and keep it within the 10-lookup limit — if you also relay through a marketing platform or a scanner, merge its include into this same record rather than adding a second v=spf1. Check the total with the SPF lookup counter.

Microsoft's official instructions: Set up SPF to identify valid email sources.

Step 2 — DKIM

Microsoft 365 DKIM is published as two CNAME records, not TXT keys. The host and target are shown to you when you enable DKIM in the Microsoft Defender portal — copy them exactly. They follow this shape (your domain with dots as dashes, and your onmicrosoft.com initial domain):

Host:  selector1._domainkey
Value: selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Host:  selector2._domainkey
Value: selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

After the CNAMEs resolve, go to security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, select your domain, and toggle Sign messages for this domain with DKIM signatures to On. DKIM does nothing until that switch is enabled.

Microsoft's official instructions: Set up DKIM to sign mail from your Microsoft 365 domain.

Step 3 — DMARC

With SPF and DKIM passing, publish a TXT record at host _dmarc:

Begin at p=none to collect aggregate reports without affecting delivery. Confirm from those reports that Exchange Online and any other source are aligned, then step up to p=quarantine and later p=reject. Validate the record and preview a safe next step in the DMARC record checker.

Microsoft's official instructions: Set up DMARC to validate the From address domain.

Where to add these records

The records go in your public DNS zone at your registrar or DNS host:

• The SPF and DMARC records are TXT; the two DKIM records are CNAME.
• Enter only the host prefix (selector1._domainkey, _dmarc, or @ for the root SPF record) — most panels append your domain for you.
• A CNAME cannot coexist with other records on the same host, and its value must be a hostname — no http:// and no trailing slash.

DNS changes can take a few hours to propagate before Microsoft can validate them.

Verify it worked

In the Defender portal the DKIM status flips to enabled once the CNAMEs resolve and signing is on. Send a test message, open the raw headers, and check for spf=pass, dkim=pass, and dmarc=pass. To see SPF lookups, DKIM presence, and DMARC alignment in one place, run a scan of your domain below.