SPF, DKIM, and DMARC for Microsoft 365: Plain-English Setup for Small Businesses (2026)

By Justin N. · Updated 2026-10-22 · This page may contain affiliate links

If your email is landing in customers' junk folders, or someone is sending fake invoices "from" your domain, these three DNS records are the fix. Microsoft 365 does part of the work automatically. The rest is about 30 minutes in your DNS host, plus a few weeks of patience on DMARC.

Who this is for: a small business that sends email from its own domain (like [email protected]) through Microsoft 365. You'll need access to your DNS host (often your domain registrar) and an admin account for the Microsoft Defender portal. Record formats below are from Microsoft Learn, checked 2026-10-22.

What these three records do

SPF is a TXT record listing which servers may send mail for your domain.
DKIM adds a digital signature to each message. Microsoft 365 publishes the public keys through two CNAME records you add to DNS.
DMARC tells receiving mail systems what to do when a message fails both checks, and where to send reports. Microsoft says a message passes DMARC if at least one of SPF or DKIM passes and lines up ("aligns") with the domain in the From address.

Microsoft's order is SPF, then DKIM, then DMARC. Its DMARC guide says to create SPF records and configure DKIM for every custom domain you send from before you configure DMARC. (Set up DMARC)

Before you start: list everything that sends as your domain

This is the step people skip, and it's the reason DMARC breaks things later. Write down every service that sends email using your domain in the From address:

Microsoft 365 (Outlook, shared mailboxes)
Your newsletter or marketing tool
Invoicing, accounting, CRM, helpdesk, or booking systems
Your website's contact form
A copier or scanner that emails scans

For bulk-email services you don't control, Microsoft recommends sending from a subdomain (for example news.yourcompany.com) so their reputation can't hurt your main domain. (Set up DMARC)

Step 1: SPF

If Microsoft 365 is your only sender, Microsoft's recommended SPF TXT record at the root of your domain is:

v=spf1 include:spf.protection.outlook.com -all

Rules Microsoft spells out (Set up SPF):

Only one SPF record per domain or subdomain. If another service tells you to "add an SPF record," add its include: to your existing record instead of creating a second one.
Use -all (hard fail). Microsoft recommends it for Microsoft 365 domains because you'll also have DKIM and DMARC.
Stay under 10 DNS lookups. More than 10 makes SPF fail with a permanent error. Each include: costs at least one lookup, and nested includes cost more, so fewer than 10 includes doesn't guarantee you're under the limit.

Example with a second sender (the include value comes from that service's own instructions):

v=spf1 include:spf.protection.outlook.com include:<your-other-service> -all

Where you add the record depends on your DNS host. Microsoft has generic steps for any provider in Add DNS records to connect your domain.

DNS host: if you're still choosing one, any registrar that lets you edit TXT and CNAME records will work. Microsoft's generic steps apply to all of them.

Step 2: DKIM

Microsoft already signs mail sent from your *.onmicrosoft.com address. For your custom domain, you turn DKIM on yourself (Set up DKIM):

In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then open the DKIM tab.
Select your custom domain. If its status says No DKIM keys saved for this domain, select Create DKIM keys.
The flyout shows two CNAME records, selector1._domainkey and selector2._domainkey. Copy the values exactly as shown. Microsoft says the values in its article are for illustration only, and the current format includes a character Microsoft assigns per domain. For example, the target looks like selector1-yourcompany-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft, but yours may differ.
Create both CNAME records at your DNS host.
Wait for DNS to update, return to the domain's flyout, and turn on Sign messages for this domain with DKIM signatures. Until DNS catches up, the status may show CnameMissing.

If you prefer PowerShell, Microsoft documents this command (Exchange Online PowerShell) to show the exact CNAME values for a domain:

Get-DkimSigningConfig -Identity yourcompany.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

Third-party senders need DKIM too. Your newsletter or invoicing tool must sign with your domain (or a subdomain of it), not its own. Otherwise SPF can pass and DMARC still fails, because the domains don't align. Microsoft's DMARC troubleshooting table lists this as a top cause. Look for "custom domain authentication" or "DKIM" in that tool's settings.

Step 3: DMARC, slowly

You create DMARC as a TXT record named _dmarc at your DNS host. Microsoft 365 has no admin page for custom-domain DMARC records. Microsoft recommends a gradual rollout (Set up DMARC):

Stage	TXT value for `_dmarc`	What it does
1. Monitor	`v=DMARC1; p=none; rua=mailto:[email protected]`	No action on failures. You just collect reports.
2. Quarantine	`v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]`	Failing mail is marked as junk or quarantined. Raise `pct` through 25, 50, 75, then 100.
3. Reject	`v=DMARC1; p=reject; rua=mailto:[email protected]`	Failing mail is typically rejected. This is the goal state.

Microsoft doesn't put a fixed number of weeks on each stage. It says to move on "after enough time monitoring." My rule of thumb: wait until at least a full billing cycle has passed in the reports so monthly senders (invoices, statements) show up. Microsoft also suggests starting with a domain or subdomain that has low mail volume and few senders.

Where reports go: Microsoft recommends a dedicated mailbox or Microsoft 365 Group for reports, not someone's personal inbox. A shared mailbox works well and doesn't need a license under 50 GB.

Why reject matters for your outbound mail: Microsoft says outbound messages from Microsoft 365 that fail DMARC at the destination are routed through its high-risk delivery pool if your policy is p=quarantine or p=reject. That's one more reason to fix alignment for every sender before you tighten the policy.

Don't forget: onmicrosoft.com and parked domains

Your *.onmicrosoft.com domain already has SPF and DKIM, but it needs its own DMARC record. You add that one in the Microsoft 365 admin center > Settings > Domains (select the onmicrosoft.com domain, open DNS records, then Add record). If you don't send from it, Microsoft's example value is v=DMARC1; p=reject.
Domains you own but don't send from (old brand names, typo domains): Microsoft recommends SPF v=spf1 -all, DMARC v=DMARC1; p=reject;, and no DKIM records.

Reading DMARC reports without losing your mind

Aggregate reports arrive as compressed XML attachments, usually about once a day per receiving provider. Microsoft notes that "the information in the Aggregate report can be vast and difficult to parse," and suggests either building your own automation or using a DMARC reporting service. It points to the Microsoft Intelligent Security Association (MISA) catalog to find one. Two facts worth knowing:

Microsoft 365 sends aggregate reports to other domains but doesn't send forensic (failure) reports, even if your record includes ruf=.
Microsoft's own guidance says to start with rua only and add ruf later if needed.

Reporting services that turn the XML into a readable dashboard include EasyDMARC. Check current plans and pricing on the vendor's own site. If you use a service like this, it typically gives you its own rua= address to put in your record. Microsoft notes that reporting services describe any custom values their DMARC record needs.

Quick troubleshooting

Symptom	Likely cause (per Microsoft)	Fix
SPF and DKIM both pass, DMARC fails	Neither domain aligns with the From domain	Have the sending service sign DKIM with your domain, or use your domain or a subdomain as its MAIL FROM
"Too many lookups" bounces	SPF over 10 DNS lookups	Remove unused includes and move bulk senders to a subdomain
`dmarc=permerror`	DMARC record syntax error, or more than one `_dmarc` record	Keep exactly one `_dmarc` TXT record and check the syntax
No aggregate reports arriving	Report mailbox unreachable, or reports going to a different domain without authorization	Fix the mailbox. For an external report domain, that domain must publish a `yourdomain._report._dmarc` TXT record

For a full list, see Troubleshoot email authentication in Microsoft 365.

Sources

Tools mentioned: DMARC reporting services such as EasyDMARC, or the MISA catalog to find others. These are ordinary links, not affiliate links.

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-22. If something has moved, tell me at [email protected].