Microsoft 365 SPF, DKIM and DMARC: the exact records, step by step

Office 365, now Microsoft 365, needs an MX record, one SPF record, two DKIM CNAMEs and a DMARC record on every domain that sends mail. Here is what each one looks like, where Microsoft hides the DKIM values, and how to keep many domains in line.

The full record set

Microsoft also asks for an autodiscover CNAME so Outlook can configure itself. It does not affect delivery, so it is not covered here.

Step 1: MX record

Microsoft 365 uses one MX record with priority 0. The host is your domain with dots replaced by dashes, under mail.protection.outlook.com:

example.com.  3600  MX  0 example-com.mail.protection.outlook.com.

Copy the exact value from the Microsoft 365 admin center (Settings → Domains → your domain → DNS records) rather than building it yourself. Domains added more recently may be given a host under mx.microsoft, which supports DNSSEC; whatever the admin center shows is correct for your domain. Remove MX records from your previous host so mail does not keep going there. See MX record priority for why.

Step 2: SPF record

example.com.  3600  TXT  "v=spf1 include:spf.protection.outlook.com -all"

Microsoft recommends -all (hard fail) once DKIM and DMARC are in place. If you are not yet sure you have found every service that sends as your domain, ~all is the safer start. Two points that trip people up:

• One SPF record per domain. If one already exists, add include:spf.protection.outlook.com to it instead of creating a second.
• Keep the total under 10 DNS lookups. The SPF checker counts them, nested includes included.

Government clouds (GCC High, DoD) and Microsoft 365 operated by 21Vianet use different include values; check Microsoft’s SPF page for yours.

Step 3: DKIM in the Defender portal

Microsoft 365 signs mail with your onmicrosoft.com domain by default. That signature does not align with your own domain, so DMARC cannot use it. To sign as your own domain:

1. Open the Microsoft Defender portal at security.microsoft.com and go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings, then the DKIM tab.
2. Click the domain row to open its details. Under Publish CNAMEs, copy the two values. (Trying the toggle first shows the same values inside an error message.)
3. At your DNS host, create two CNAME records with exactly those values.
4. Wait a few minutes, sometimes longer, for Microsoft to detect them.
5. Back in the domain details, turn on Sign messages for this domain with DKIM signatures. The status should change to Valid.

The CNAME targets come in two formats. Domains set up before May 2025 usually have this one:

selector1._domainkey.example.com.  CNAME  selector1-example-com._domainkey.contoso.onmicrosoft.com.
selector2._domainkey.example.com.  CNAME  selector2-example-com._domainkey.contoso.onmicrosoft.com.

Here contoso stands for your tenant’s initial onmicrosoft.com name. Custom domains added since May 2025 get the newer format, with a partition letter Microsoft assigns:

selector1._domainkey.example.com.  CNAME  selector1-example-com._domainkey.contoso.n-v1.dkim.mail.microsoft.
selector2._domainkey.example.com.  CNAME  selector2-example-com._domainkey.contoso.n-v1.dkim.mail.microsoft.

The letter (n above) is not something you can guess, which is the main reason to copy the exact values from the Defender portal. In Exchange Online PowerShell, Get-DkimSigningConfig -Identity example.com | Format-List Selector1CNAME,Selector2CNAME prints the same values.

Why two records? Microsoft signs with one selector and keeps the other ready for key rotation. Both CNAMEs must stay in DNS. After you rotate keys in the portal, the new key takes about four days to start signing.

Step 4: DMARC and the move to reject

There is no DMARC setting in Microsoft 365 for custom domains; you add the TXT record at your DNS host. Start in monitoring mode:

_dmarc.example.com.  3600  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Read the aggregate reports for a few weeks. Every legitimate source, such as Microsoft 365, your newsletter tool and your invoicing app, should pass SPF or DKIM aligned with your domain. Then step up:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
; then, when the reports show nothing legitimate failing:
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Microsoft’s own target is p=reject for every domain. For domains that never send mail, publish v=spf1 -all and v=DMARC1; p=reject straight away. The DMARC checker shows what each domain publishes now.

Outlook.com rules for high-volume senders

Since May 5, 2025, Microsoft requires domains that send more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses to meet these rules:

Mail that does not comply is routed to Junk, and Microsoft has said that later it will be rejected outright with 550 5.7.515 Access denied. Microsoft also asks large senders to offer a working unsubscribe link, keep lists clean and use valid From and Reply-To addresses. These are almost the same as Gmail’s bulk sender rules, so one setup covers both.

Doing this for 20 domains

MX, SPF and DMARC are the same text on every domain apart from the MX host name. DKIM is the slow part: each domain has its own pair of CNAMEs and its own toggle in Defender. Across 20 domains, the usual gaps are a domain where the CNAMEs were published but signing was never turned on, a second SPF record added by a marketing tool, and domains still on p=none years later.

1. List every accepted domain in the tenant, including ones that only receive.
2. Add MX, SPF and DMARC to all of them in one sitting.
3. In Defender, copy and publish the DKIM CNAMEs for each domain, then come back and turn on signing for each one.
4. Paste the full list into the free bulk mail health checker. It checks MX, SPF, DKIM (including selector1 and selector2), DMARC, the STARTTLS certificate, blacklists and PTR for up to 25 domains at once, with a copy-ready fix for anything that is not green.
5. Turn on weekly monitoring under the report, so a record that changes later is caught.

Questions

Sources

• Microsoft Learn: Connect your domain by adding DNS records
• Microsoft Learn: Set up SPF for your Microsoft 365 domain
• Microsoft Learn: How to use DKIM for email in your custom domain
• Microsoft Learn: Set up DMARC to validate email in Microsoft 365
• Microsoft Tech Community: Outlook’s new requirements for high-volume senders