emailsecops
Menu
Guides

Microsoft 365 SPF, DKIM and DMARC setup

Publish include:spf.protection.outlook.com in your root SPF record and two DKIM CNAMEs (selector1 and selector2), then enable DKIM for the domain. Custom domains added since May 2025 use a new CNAME target under dkim.mail.microsoft. SPF and DKIM both align.

Mailbox provider · reviewed October 13, 2026 against Microsoft 365's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Microsoft 365 account: copy it from Microsoft 365's setup screen, which shows the exact record.

ForTypeHostValue
Domain verification TXT {domain} MS=ms{8-digit-number}Shown by the domain setup wizard; an MX record or a website file can verify the domain instead.
Receiving mail MX {domain} priority 0 · {domain-key}.mail.protection.outlook.comCopy the exact value from the Microsoft 365 admin center; use the highest priority available, typically 0.
SPF TXT {domain} v=spf1 include:spf.protection.outlook.com -allWorldwide and GCC; GCC High and DoD use include:spf.protection.office365.us, 21Vianet include:spf.protection.partner.outlook.cn.
DKIMCustom domains added since May 2025 CNAME selector1._domainkey.{domain} selector1-{domain-with-dashes}._domainkey.{initial-domain-prefix}.{partition-character}-v1.dkim.mail.microsoft{initial-domain-prefix} is the custom part of your onmicrosoft.com domain; copy the exact value from the Defender portal.
DKIMCustom domains added since May 2025 CNAME selector2._domainkey.{domain} selector2-{domain-with-dashes}._domainkey.{initial-domain-prefix}.{partition-character}-v1.dkim.mail.microsoftSame partition letter as selector1; needed for key rotation even though one selector signs at a time.
DKIMOlder custom domains CNAME selector1._domainkey.{domain} selector1-{domain-with-dashes}._domainkey.{initial-domain-prefix}.onmicrosoft.comCustom domains that existed before May 2025; the old and new formats can't coexist for the same selector.
DKIMOlder custom domains CNAME selector2._domainkey.{domain} selector2-{domain-with-dashes}._domainkey.{initial-domain-prefix}.onmicrosoft.com
DMARC optional TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Microsoft advises p=none first, then quarantine, then reject; for a parked domain it suggests v=DMARC1; p=reject;

SPF

Publish v=spf1 include:spf.protection.outlook.com -all at your root domain; GCC High and DoD use include:spf.protection.office365.us, and 21Vianet include:spf.protection.partner.outlook.cn. Exchange Online sends with the user's address as the MAIL FROM, so SPF passes and aligns with your From domain.

DKIM

Publish two CNAMEs, selector1._domainkey and selector2._domainkey, then enable DKIM for the custom domain; Microsoft doesn't sign as that domain until you do. PowerShell creates 1024-bit RSA keys unless you pass -KeySize 2048, and 2048-bit can also be chosen at rotation. Rotation is manual (Rotate DKIM keys in the Defender portal, or Rotate-DkimSigningConfig) and the switch takes four days.

DMARC alignment

Both align once set up: SPF because Exchange Online uses the sender's address as the MAIL FROM, and DKIM after you publish both selector CNAMEs and enable DKIM for the custom domain. Mail signed only by your tenant's onmicrosoft.com domain does not align.

Common mistakes

  • Custom domains added since May 2025 get the new CNAME target under dkim.mail.microsoft while older ones keep onmicrosoft.com, so copy the values from the Defender portal or Get-DkimSigningConfig instead of building them by hand.
  • Publish both selector1 and selector2; without selector2, key rotation fails later.
  • Many DNS hosts append the zone, so enter only selector1._domainkey there; typing the full name creates selector1._domainkey.example.com.example.com.
  • Keep one SPF record per domain within 10 DNS lookups, and don't flatten include:spf.protection.outlook.com, as Microsoft warns.
  • Microsoft 365 never sends DMARC forensic (ruf) reports, and sends aggregate reports only when your MX points directly to Microsoft 365.
  • With p=quarantine or p=reject, outbound mail that fails DMARC at the destination is routed through the high-risk delivery pool.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Microsoft 365

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: spf.protection.outlook.com, spf.protection.office365.us, spf.protection.partner.outlook.cn
  • Default DKIM selectors: selector1, selector2
  • DKIM keys delegated (CNAME) to *.onmicrosoft.com, *.dkim.mail.microsoft

Questions

What SPF record does Microsoft 365 need?+
Publish v=spf1 include:spf.protection.outlook.com -all at your root domain; GCC High and DoD use include:spf.protection.office365.us, and 21Vianet include:spf.protection.partner.outlook.cn. Exchange Online sends with the user's address as the MAIL FROM, so SPF passes and aligns with your From domain.
What are the DKIM records for Microsoft 365?+
Publish two CNAMEs, selector1._domainkey and selector2._domainkey, then enable DKIM for the custom domain; Microsoft doesn't sign as that domain until you do. PowerShell creates 1024-bit RSA keys unless you pass -KeySize 2048, and 2048-bit can also be chosen at rotation. Rotation is manual (Rotate DKIM keys in the Defender portal, or Rotate-DkimSigningConfig) and the switch takes four days.
Does Microsoft 365 mail pass DMARC?+
Both align once set up: SPF because Exchange Online uses the sender's address as the MAIL FROM, and DKIM after you publish both selector CNAMEs and enable DKIM for the custom domain. Mail signed only by your tenant's onmicrosoft.com domain does not align.
Do I need a separate DMARC record for Microsoft 365?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources