Microsoft 365 email authentication setup
Steps to publish SPF, enable DKIM and roll out DMARC for a domain sending through Microsoft 365 / Exchange Online. These are DNS changes at your domain registrar or DNS host — not inside the Microsoft 365 admin centre — except where noted.
1. SPF
Add (or edit, if one already exists — a domain can only have one SPF record) a TXT record at your domain's apex:
| Host | Type | Value |
|---|---|---|
@ (or your domain itself) | TXT | v=spf1 include:spf.protection.outlook.com -all |
If you also send through other services (a CRM, invoicing platform, marketing tool, your
website's contact form), each needs its own include: added to the same
record — never publish two separate SPF TXT records. Use the
SPF generator to combine multiple
providers correctly, and start with ~all instead of -all while
you confirm every legitimate sender is covered.
2. DKIM
Microsoft 365 signs mail with a default, Microsoft-owned domain unless you enable custom DKIM for your own domain — until you do, DKIM won't validate as coming from your domain specifically. To enable it:
- In the Microsoft 365 Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
- Select your domain. Microsoft 365 will display two CNAME records to publish (selectors
selector1andselector2). - Publish both CNAMEs at your DNS host exactly as shown.
- Return to the DKIM screen and toggle signing on for the domain.
The exact menu path changes occasionally as Microsoft updates the admin centre — search "DKIM" from the Defender portal's search bar if it's moved.
3. DMARC
Once SPF is published and DKIM is signing, add a DMARC TXT record:
| Host | Type | Value |
|---|---|---|
_dmarc | TXT | v=DMARC1; p=none; rua=mailto:[email protected] |
Start at p=none and read the aggregate reports it generates before moving to
quarantine then reject — see
DMARC and
DMARC reports for why, and the
DMARC generator to build the record.
Common Microsoft 365 pitfalls
- Publishing a second SPF TXT record instead of editing the existing one — only one is valid; a second silently breaks SPF.
- Enabling DMARC enforcement before custom DKIM is actually signing — mail can fail DMARC alignment even though it's genuinely from you.
- Forgetting a third-party sender (a CRM, form, or marketing tool) that also sends "from" your domain — it needs its own SPF include and ideally its own DKIM selector before you enforce DMARC.
Run a free check after each step to confirm it's live.