Microsoft 365 email setup: SPF, DKIM and DMARC step by step

Which domain are you setting up?

Microsoft configures SPF and DKIM for your *.onmicrosoft.com domain itself; you only need to add its DMARC record in the Microsoft 365 admin center.^[1][3] This guide is for your custom domain (yourcompany.com), where you create every record at your DNS host. Microsoft has no portal for SPF or DMARC records on custom domains; they live at your registrar or DNS host.^[1]

Step 1: SPF

If Microsoft 365 is the only service that sends mail as your domain, Microsoft’s recommended record is:^[1]

v=spf1 include:spf.protection.outlook.com -all

Add it as a TXT record on the domain itself. Microsoft recommends -all (hard fail) for Microsoft 365 domains because it also recommends DKIM and DMARC.^[1] Keep to one SPF record per domain or subdomain; multiple records make SPF return permerror.^[1] If other services send as you, add their includes to the same record, and remember that each include costs DNS lookups toward the limit of 10.^[1]

Step 2: DKIM

1. In the Defender portal (security.microsoft.com) open Email & collaboration › Policies & rules › Threat policies › Email authentication settings, then the DKIM tab.^[2]
2. Select your domain. Microsoft shows two CNAME records to create. The host names are the same for everyone: selector1._domainkey and selector2._domainkey.^[2]
3. Copy the values exactly. In the current format they point into dkim.mail.microsoft, for example selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft; yours will contain your own domain and tenant.^[2]
4. Create both CNAME records at your DNS host.
5. After they resolve, return to the domain in the DKIM tab and turn on Sign messages for this domain with DKIM signatures.^[2]

Two selectors exist so Microsoft can rotate keys without a gap in signing.

Step 3: DMARC

Add a TXT record with host _dmarc. Microsoft recommends a gradual rollout: start at p=none, monitor, move to p=quarantine, then p=reject, starting with low-volume subdomains and leaving the parent domain for last.^[3] A first record:

v=DMARC1; p=none; rua=mailto:[email protected]

Microsoft’s examples still use pct= to step through percentages.^[3] RFC 9989, the DMARC standard published in May 2026, removed pct and introduced t=y (test mode), which asks receivers to apply one level lower than the published policy.^[4] Either way, the order is the same: watch reports until every legitimate sender aligns, then tighten one step.

Parked domains

For domains you own but never send from, Microsoft suggests v=spf1 -all as SPF and v=DMARC1; p=reject; as DMARC, so nobody can send convincing mail as them.^[1][3]

Common mistakes

• Leaving an old SPF record from a previous host next to the new one.
• Creating the DKIM CNAMEs but never switching signing on.
• Using a third-party sender (marketing, CRM) on the main domain with its own DKIM domain: SPF may pass for them, but DMARC fails because nothing aligns. Microsoft recommends putting services you don’t control on a subdomain.^[1]

Sources

1. Set up SPF to identify valid email sources for your Microsoft 365 domain · Microsoft LearnChecked 5 Oct 2026
2. How to use DKIM for email in your custom domain · Microsoft LearnChecked 5 Oct 2026
3. Set up DMARC to validate email in Microsoft 365 · Microsoft LearnChecked 5 Oct 2026
4. RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (May 2026) · IETF / RFC EditorChecked 5 Oct 2026