Guides · Updated 2026-10-11

DMARC, SPF and DKIM for Microsoft 365: step by step

1. SPF

If Microsoft 365 is your only sender:

v=spf1 include:spf.protection.outlook.com -all

Add other services' includes to the same single record.

2. DKIM

1. In the Microsoft Defender portal, open Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM.
2. Select your custom domain. Microsoft shows two CNAME records, for selector1._domainkey and selector2._domainkey. Copy the exact target values shown for your tenant (the format differs between older and newer domains).
3. Publish both CNAMEs at your DNS host, then turn on Sign messages for this domain with DKIM signatures.

Without this, Microsoft 365 signs with your onmicrosoft.com domain, which does not align with your custom domain for DMARC.

3. DMARC

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com at _dmarc.yourdomain.com, then step up to quarantine and reject. Microsoft also recommends DMARC for the *.onmicrosoft.com domain if you send from it.

Sources

• Microsoft Learn: Set up SPF for your domain
• Microsoft Learn: Set up DKIM
• Microsoft Learn: Set up DMARC

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.