DNS guides

Setup guide

Microsoft 365 SPF, DKIM and DMARC setup

SPF, DKIM, DMARC and MX for a Microsoft 365 (Exchange Online) domain: the SPF include, the two DKIM CNAMEs from the Defender portal, and DMARC.

Set them up in this order: SPF and DKIM first, then DMARC, which relies on both. All are records at your DNS provider (where you bought the domain, or Cloudflare), not in Microsoft 365.

1. SPF

One TXT record on the root of the domain. If other tools send as you, add their includes to this same record — a domain can have only one SPF record.

TXT · host @

v=spf1 include:spf.protection.outlook.com ~all

2. DKIM

The key is generated per domain, so copy it from Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.

  1. Select your domain. Microsoft shows two CNAME records, selector1._domainkey and selector2._domainkey, with targets specific to your tenant.
  2. Add both CNAMEs at your DNS provider exactly as shown.
  3. Back in the portal, turn on Sign messages for this domain with DKIM signatures.

Record type: CNAME. Not showing up? DKIM record not found.

3. DMARC

A TXT record at _dmarc. Start by monitoring with p=none and your own report address, then move to quarantine and reject.

TXT · host _dmarc

v=DMARC1; p=none; rua=mailto:[email protected]

4. MX

So replies to your outreach are delivered.

MX · host @

MX 0 <your-domain>.mail.protection.outlook.com

Use the exact host the Microsoft 365 admin center shows under Settings → Domains for your domain.

Questions

Why CNAMEs instead of a TXT key?

Microsoft hosts the keys and rotates them; your CNAMEs point at them, so you never update the key yourself.

Which selectors does the checker try?

selector1 and selector2, the ones Microsoft 365 uses.

Last checked 2026-10-21. Providers move their settings around; if a menu above has changed, search Microsoft 365's admin help for “DKIM” or “SPF”.

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works