Sign inMonitor a domain
include:spf.protection.outlook.com

To let Microsoft 365 (Exchange Online) send as you, add include:spf.protection.outlook.com to your SPF.

Vendor docs checked 5 Oct 2026 · lookup cost measured 5 Nov 2026 by peekip

Short answer

On each custom domain you send from. Microsoft says most Microsoft 365 organizations need include:spf.protection.outlook.com in the domain’s SPF record. Measured on 5 Nov 2026, the include costs 1 of your 10 SPF lookups, leaving 9 for everything else.

Include
spf.protection.outlook.com
Vendor’s record
include:spf.protection.outlook.com
Where it goes
Your domain’s SPF record (@)
Needed on your root?
Yes, if you send through it from your domain
Lookups (measured)
1 of 10
Ranges published
6 ip4 · 5 ip6
Category
Mailbox provider

What include:spf.protection.outlook.com expands to live, 5 Nov 2026

include:spf.protection.outlook.com · 1
v=spf1your SPF record · total 1
└include:spf.protection.outlook.com1
├ip4:40.92.0.0/150
├ip4:40.107.0.0/160
├ip4:52.100.0.0/150
├ip4:52.102.0.0/160
├ip4:52.103.0.0/170
├ip4:104.47.0.0/170
├ip6:2a01:111:f400::/480
├ip6:2a01:111:f403::/490
├ip6:2a01:111:f403:8000::/510
├ip6:2a01:111:f403:c000::/510
├ip6:2a01:111:f403:f000::/520
└-all0
v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all

Counted as RFC 7208 §4.6.4 does: the include itself plus every nested include, a, mx, ptr, exists and redirect. Includes can change at any time; this page re-measures daily.

Adding it next to another service

A domain has exactly one SPF record, so add the include to the record you already have. With Google Workspace, for example:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
Build yours in the generator

DKIM for Microsoft 365 (Exchange Online)

Two CNAMEs, selector1._domainkey and selector2._domainkey, with values shown in the Defender portal (Email authentication settings → DKIM).

How it affects DMARC

DMARC passes when SPF or DKIM passes for a domain aligned with your From address. With Microsoft 365 (Exchange Online) sending from your domain, its include lets SPF pass and align; DKIM signing with your domain gives you a second, forwarding-proof way to pass.

Other mailbox provider services

Google Workspaceinclude:_spf.google.comZoho Mailinclude:zohomail.comGoDaddy email and hostinginclude:secureserver.netProton Mailinclude:_spf.protonmail.chFastmailinclude:spf.messagingengine.com

Sources

  1. Microsoft Learn: Set up SPF for custom cloud domains · checked 5 Oct 2026
  2. Microsoft Learn: Configure DKIM · checked 5 Oct 2026
  3. RFC 7208 §4.6.4: DNS lookup limits · checked 5 Oct 2026

peekip isn’t affiliated with Microsoft 365; follow the vendor’s own setup page, which shows the exact values for your account.