SPF, DKIM and DMARC are three DNS records that prove email from your domain is genuine. Together they stop attackers from spoofing your domain, improve inbox delivery and are now required by major mailbox providers for bulk senders.
This guide shows how to set up SPF, DKIM and DMARC for Microsoft 365 step by step, how to move safely to DMARC enforcement, and which mistakes cause legitimate email to fail.
SPF vs DKIM vs DMARC: What Each One Does
| Record | What it checks | Where it lives |
|---|---|---|
| SPF | Which servers may send email for your domain | TXT record on your domain |
| DKIM | A digital signature proving the message was not changed | CNAME records pointing to Microsoft 365 keys |
| DMARC | Whether SPF or DKIM passed with an aligned domain, and what to do if not | TXT record at _dmarc.yourdomain |
SPF and DKIM authenticate the message. DMARC tells receiving servers what to do when authentication fails and sends you reports.
Step 1: Set Up SPF for Microsoft 365
Create one TXT record at the root of your domain. If Microsoft 365 is your only sender, use:
v=spf1 include:spf.protection.outlook.com -all- Add an
include:for each other service that sends as your domain, such as a CRM or marketing platform. - Keep only one SPF record per domain.
- Stay under the 10 DNS lookup limit, or SPF will fail.
- Use
-all(hard fail) once you are confident all senders are listed.
Step 2: Enable DKIM in Microsoft 365
- Open the Microsoft Defender portal and go to Email & collaboration, Policies & rules, Threat policies, then Email authentication settings.
- Select the DKIM tab and choose your custom domain.
- Copy the two CNAME values shown (selector1 and selector2).
- Publish both CNAME records at your DNS provider exactly as shown.
- Wait for DNS to update, then switch Sign messages for this domain with DKIM signatures to enabled.
Always copy the CNAME targets from your own tenant. Microsoft has changed the format over time, so values from old guides may not match.
Step 3: Publish a DMARC Record
Create a TXT record at _dmarc.yourdomain.com. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:[email protected]; fo=1The rua address receives daily aggregate reports from receiving servers. Use a dedicated mailbox or a DMARC reporting service, because report volume can be high.
Step 4: Move From p=none to p=reject Safely
| Phase | Policy | Goal | Typical length |
|---|---|---|---|
| Monitor | p=none | Find every service sending as your domain | 2 to 4 weeks |
| Fix | p=none | Add SPF includes and DKIM for each sender | 1 to 4 weeks |
| Quarantine | p=quarantine; pct=25 to 100 | Send failures to junk, increase gradually | 2 to 4 weeks |
| Enforce | p=reject | Block spoofed email completely | Ongoing |
Review reports at every stage. If a legitimate service fails, fix its authentication before tightening the policy.
Inbound Protection: Make Microsoft 365 Honour DMARC
Publishing DMARC protects your domain when others receive your email. To protect your own users, check your anti-phishing policy in Defender for Office 365. Make sure it honours the sender’s DMARC policy for quarantine and reject, and enable spoof and impersonation protection.
These settings also improve your Microsoft Secure Score.
Common SPF, DKIM and DMARC Mistakes
- Two SPF records on one domain, which makes both invalid.
- Too many SPF lookups after adding many marketing tools.
- DKIM CNAMEs published but signing never enabled in the portal.
- Jumping straight to p=reject and blocking invoices or newsletters.
- Forgetting parked domains, which attackers love to spoof.
- Forgetting subdomains used by marketing or support platforms.
Setting Up Email Authentication During a Migration
If you are moving to Exchange Online, plan DNS changes as part of the cutover. Our guide on planning an Exchange Online migration without mail downtime covers MX and SPF timing.
Secure Your Email With M365 Enterprise Hub
Email spoofing is one of the most common routes to payment fraud in the UAE and Saudi Arabia. Our team sets up SPF, DKIM and DMARC, monitors reports and moves you to enforcement without breaking business email. See our email security hardening services, enterprise email security and Exchange Online setup, or book a free email security check.
Frequently Asked Questions
What is the SPF record for Microsoft 365?
For a domain that sends only through Microsoft 365, the SPF record is v=spf1 include:spf.protection.outlook.com -all. Add includes for any other services that send mail as your domain.
Is DKIM enabled by default in Microsoft 365?
Only for the default onmicrosoft.com domain. For your custom domains, you must publish two CNAME records and then enable DKIM signing in the Microsoft Defender portal.
What DMARC policy should I start with?
Start with p=none and a reporting address to collect data. Move to p=quarantine and then p=reject once all legitimate senders pass SPF or DKIM with alignment.
How long does it take to reach DMARC p=reject?
Most organizations need four to twelve weeks, depending on how many third-party services send email as their domain.
Will DMARC stop all phishing?
No. DMARC stops attackers from spoofing your exact domain. It does not stop look-alike domains or compromised accounts, so you still need anti-phishing policies and MFA.
Do I need DMARC to send to Outlook.com and Gmail?
Large senders do. Microsoft, Google and Yahoo require SPF, DKIM and at least a p=none DMARC record for high-volume senders. Every domain benefits from DMARC regardless of volume.
What is DMARC alignment?
Alignment means the domain in the visible From address matches the domain authenticated by SPF or DKIM. DMARC passes only when at least one aligned check passes.
Can I protect domains that never send email?
Yes. Publish v=spf1 -all and a DMARC record with p=reject so nobody can send email using that domain.