SPF, DKIM, and DMARC Checker for Microsoft 365

By Justin N. · Published 2026-10-23 · Free, no sign-up

Enter your domain to check its SPF, DKIM, and DMARC records against Microsoft's recommended setup for Microsoft 365. It takes a few seconds, it's free, and you don't need to sign in.

This checker runs in your browser and needs JavaScript. You can still check your records by hand with the steps in the SPF, DKIM, and DMARC guide.

What it checks

Mail provider: whether your domain's MX record points to Microsoft 365, either the long-standing mail.protection.outlook.com hosts or the newer mx.microsoft hosts.
SPF: that there's exactly one SPF record (Microsoft allows only one per domain or subdomain), that it includes spf.protection.outlook.com when Microsoft 365 handles your mail (Microsoft's recommended record is v=spf1 include:spf.protection.outlook.com -all), how it ends (Microsoft recommends -all for Microsoft 365 domains), and whether it stays within the limit of 10 DNS lookups, counting the records your includes pull in. Past 10, SPF fails with a permanent error. (Microsoft Learn: Set up SPF)
DKIM: whether the two Microsoft 365 CNAME records (selector1._domainkey and selector2._domainkey) are published, plus any extra selector you enter. (Microsoft Learn: Set up DKIM)
DMARC: that there's exactly one _dmarc record, which policy it sets (none, quarantine, or reject), and whether reports are being sent anywhere. If you check a subdomain with no record of its own, it looks up the parent domain's record, which then applies. (Microsoft Learn: Set up DMARC)

What it can't tell you

Whether DKIM signing is turned on. The CNAME records can be in place while signing is still off in the Microsoft Defender portal. Check the domain's status on the DKIM tab, as described in Step 2 of the guide.
Whether your other senders line up. A newsletter or invoicing tool can pass its own checks and still fail DMARC for your domain. Your DMARC reports are where that shows up.
Whether a message actually got delivered. This looks at published DNS records, not at real messages. To check a real message, send it to an outside mailbox and read the authentication results in its headers.

How it works, and your privacy

Your browser looks up your domain's public DNS records directly through Cloudflare's public DNS resolver (1.1.1.1, using DNS over HTTPS). The domain you type isn't sent to AdminPlainly, isn't added to the page address, and isn't stored by this site. The records it reads are public information anyone can look up. Cloudflare's handling of those lookups is covered by its 1.1.1.1 privacy commitments.

Fix what it finds

Each result links to the matching step in SPF, DKIM, and DMARC for Microsoft 365, which walks through the exact records, where to turn on DKIM, and a safe DMARC rollout from p=none to p=reject.

Sources

The checks and recommendations above follow Microsoft's documentation, checked 2026-10-23:

Set up SPF to help prevent spoofing: the recommended record, -all, the one-record rule, and the 10-lookup limit.
Set up DKIM to sign mail from your Microsoft 365 domain: the selector1 and selector2 CNAME records.
Set up DMARC to validate the From address domain: policies, the gradual rollout, and reports.