Skip to main content

Microsoft 365 email authentication: SPF, DKIM and DMARC

Microsoft 365 gives you MX and SPF during domain setup, but DKIM is off for custom domains until you publish two CNAMEs and switch it on, and DMARC is yours to publish. This guide takes the domain from the setup wizard defaults to enforced authentication.

Record values checked against Microsoft 365’s own documentation on 2026-11-10. Every section links its source.

Only need the quick answer? Microsoft 365 SPF and MX records (quick answer) · Short version of this setup. This page is the full setup, including how it interacts with your other senders.

Check your domain against Microsoft 365

Enter the domain you send from. We run the checks on the live DNS and show what is missing.

Free, no signup. The scan reads public DNS records only.

MX records for Microsoft 365

Microsoft 365 MX records
TypeNamePriority and host
MX@0 <mx-token>.mail.protection.outlook.com
  • Copy the exact MX value from the Microsoft 365 admin center (Settings > Domains > your domain > DNS records). Microsoft says to find your MX token there rather than build the name yourself.
  • Microsoft asks for a priority lower than any other MX record so mail is delivered to Exchange Online; the admin center guide uses 0, Microsoft reference table gives 1 as an example. Either works as long as it is the lowest number.
  • TTL 3600. Exchange Online only supports TTL values below 6 hours (21,600 seconds).
  • Remove MX records that still point to the previous provider, or give them a higher number than Microsoft.
Microsoft: External DNS records for Microsoft 365

SPF for Microsoft 365

The mechanism to add is include:spf.protection.outlook.com. A domain can publish only one SPF record, so you add it to the record that exists, you do not create a second one.

Microsoft 365 is your only sender

v=spf1 include:spf.protection.outlook.com -all

Merging into an existing record

Before

v=spf1 ip4:203.0.113.25 include:_spf.crm.example ~all

After

v=spf1 ip4:203.0.113.25 include:spf.protection.outlook.com include:_spf.crm.example ~all

Lookup budget

SPF allows 10 DNS-querying terms in total (RFC 7208), nested includes included. This include costs 1 DNS lookup (the include itself plus whatever it points to), measured by querying DNS on 2026-11-10. That leaves 9 for every other sender. Providers change their records, so re-measure with the SPF checker before you add the next one.

  • Microsoft recommends -all (hard fail) for Microsoft 365 domains because DKIM and DMARC are recommended alongside it.
  • Government clouds differ: GCC High and DoD use include:spf.protection.office365.us, and Microsoft 365 operated by 21Vianet uses include:spf.protection.partner.outlook.cn.
  • Microsoft says to add its include to the existing SPF record and not to delete what is already there. There is no admin portal or cmdlet for SPF: you edit the TXT record at your DNS host.
  • Microsoft recommends a subdomain for bulk email services you do not control, so their reputation and lookups stay away from your main domain. Each subdomain needs its own SPF record.
  • Do not flatten spf.protection.outlook.com. Microsoft says its sending infrastructure uses IP addresses that change frequently.
Microsoft: Set up SPF for Microsoft 365

DKIM for Microsoft 365

Where: Microsoft Defender portal: Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM tab (security.microsoft.com/authentication?viewid=DKIM)

  1. In the Defender portal open the DKIM tab and select your custom domain.
  2. Note the two CNAME values in the Publish CNAMEs section. Exchange Online PowerShell shows the same values: Get-DkimSigningConfig -Identity <domain> | Format-List Selector1CNAME,Selector2CNAME.
  3. Publish both CNAME records at your DNS host: selector1._domainkey and selector2._domainkey.
  4. Wait a few minutes (it can take longer), then switch on Sign messages for this domain with DKIM signatures. The status changes to Signing DKIM signatures for this domain.
Microsoft 365 DKIM records
TypeNameValue
CNAMEselector1._domainkeyselector1-<domain-with-dashes>._domainkey.<initial-domain-prefix>.<partition-character>-v1.dkim.mail.microsoft

Format for custom domains added since May 2025. Older domains use selector1-<domain-with-dashes>._domainkey.<initial-domain-prefix>.onmicrosoft.com. The two formats cannot coexist for one selector, so copy the exact value from the portal or PowerShell.

CNAMEselector2._domainkeyselector2-<domain-with-dashes>._domainkey.<initial-domain-prefix>.<partition-character>-v1.dkim.mail.microsoft

Same pattern with selector2. The partition character (for example r or n) is assigned by Microsoft and is the same for both selectors.

Selector. Microsoft 365 publishes two selectors, selector1 and selector2, but only one signs at a time. The other is used after a key rotation.

  • A custom domain starts signing once Microsoft detects the CNAMEs and signing is enabled. Until then, mail is not signed with your own domain, so DKIM cannot align with your From domain.
  • New-DkimSigningConfig defaults to a 1024-bit key; add -KeySize 2048 for a 2048-bit key, or run Rotate-DkimSigningConfig -KeySize 2048 on an existing domain.
  • A rotation is not immediate: it takes four days (96 hours) before the new private key starts signing.
  • Microsoft does not recommend DKIM CNAME records for parked domains that send no mail.
Microsoft: Set up DKIM for Microsoft 365

DMARC with Microsoft 365

DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.

  • There is no portal or cmdlet for DMARC on custom domains: create the TXT record at _dmarc at your DNS host. The *.onmicrosoft.com domain is the exception, its DMARC record is added in the Microsoft 365 admin center.
  • Microsoft suggests starting with a domain or subdomain that has low mail volume and few sources, and finishing with the parent domain. Subdomains inherit the parent DMARC record unless they publish their own.
  • To move the policy up gradually Microsoft uses pct in steps of 10, 25, 50, 75 and 100 within each policy level.
  • Microsoft 365 does not send DMARC forensic (ruf) reports. It sends aggregate reports to a valid rua address as long as your MX points directly to Microsoft 365.
  • Outbound mail from a domain with p=quarantine or p=reject that fails DMARC at the destination goes through the high-risk delivery pool.
Microsoft: Set up DMARC for Microsoft 365

  1. Step 1

    Monitor

    v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

    Publish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.

  2. Step 2

    Quarantine

    v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

    Failing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.

  3. Step 3

    Reject

    v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

    Failing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.

A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.

Common Microsoft 365 mistakes

  • Creating a second SPF record for Microsoft 365 when one exists. Two SPF records give permerror. Add the Microsoft include to the current record.
  • Typing the include wrongly. Microsoft lists three failures: a trailing dot (include:spf.protection.outlook.com.), an equals sign instead of a colon (include=), and a space after the colon.
  • Publishing the DKIM CNAMEs but never switching signing on, or switching it on before the CNAMEs are detected.
  • Copying DKIM CNAME targets from an old guide. New domains use the dkim.mail.microsoft form with a partition character that only your tenant knows.
  • Pointing Microsoft 365 SPF -all at a domain that other tools also send from. Add those senders first or you will fail your own mail.
  • Forgetting that undefined subdomains are covered by DMARC but not by SPF or DKIM: every subdomain that sends needs its own SPF and DKIM.
  • Leaving the old provider MX records with a lower number than Microsoft, so mail never reaches Exchange Online.

Microsoft 365 email authentication FAQ

What is the SPF record for Microsoft 365?

v=spf1 include:spf.protection.outlook.com -all for a domain that only sends through Exchange Online. If other services also send as your domain, merge their includes into the same record. Microsoft government clouds and 21Vianet use different include hosts.

Where do I enable DKIM in Microsoft 365?

In the Microsoft Defender portal under Email & collaboration > Policies & rules > Threat policies > Email authentication settings, on the DKIM tab. Publish selector1 and selector2 CNAMEs first, then switch on signing for the domain.

Why does Microsoft 365 use CNAME records for DKIM and not TXT?

The CNAMEs point to the public keys, which Microsoft publishes under its own name. There are two selectors because only one signs at a time: the other takes over after a key rotation.

Is a 1024-bit DKIM key enough?

Microsoft offers 1024 and 2048. A new signing config defaults to 1024, so request 2048 with the KeySize parameter or rotate the keys with -KeySize 2048.

Does the onmicrosoft.com domain need DNS records?

SPF and DKIM are already configured for it. If you do not use it for mail, Microsoft says to publish a reject DMARC record for it in the admin center too.

Can I have SPF records for both Microsoft 365 and my other senders?

Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.

How do I check my Microsoft 365 authentication after changing DNS?

Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.

Sources