SPF, DKIM and DMARC · Checked 8 November 2026

Microsoft 365 SPF, DKIM and DMARC records

The records that let mail sent through Microsoft 365 pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

example.com.  IN  TXT  "v=spf1 include:spf.protection.outlook.com -all"
  • Publish it as a TXT record for your custom domain at your DNS host. Microsoft recommends -all, because you should also set up DKIM and DMARC.
  • Government and China clouds use a different include: spf.protection.office365.us for GCC High and DoD, and spf.protection.partner.outlook.cn for 21Vianet.
  • If you also send from an on-premises server, add it to the same record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all.
  • Only one SPF record per domain, and each subdomain needs its own. Microsoft suggests a TTL of at least 3600 seconds.
  • Do not replace the Microsoft include with IP addresses ("flattening"): Microsoft says its sending addresses change often.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • Microsoft 365 signs with two keys, so you publish two CNAME records: host selector1._domainkey and host selector2._domainkey.
  • Each CNAME points to a name built from your domain and your Microsoft 365 initial domain. The exact targets are shown in the Defender portal, or by running Get-DkimSigningConfig -Identity example.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME in Exchange Online PowerShell. Copy them from there.
  • Publish both CNAMEs, then turn on signing for the domain in the Defender portal. Until the records are found, the status shows CnameMissing.
  • Microsoft rotates between the two selectors, which is why both must stay in DNS.
selector1._domainkey.example.com.  IN  CNAME  selector1-example-com._domainkey.<your-tenant>.<partition>-v1.dkim.mail.microsoft.

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • Only one of the two DKIM CNAMEs published. Both are required.
  • A DNS host that appends your domain to the target, producing a wrong name. Enter the target exactly, and check it with the DKIM checker.
  • An SPF record that includes spf.protection.outlook.com but exceeds 10 DNS lookups once other services are added.
  • Mail from bulk services sent as the main domain. Microsoft suggests a subdomain for those, with its own SPF record.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

What is the SPF record for Microsoft 365?

v=spf1 include:spf.protection.outlook.com -all for most organisations. GCC High, DoD and 21Vianet use different include values.

Why does Microsoft 365 DKIM use two CNAME records?

It signs with two key pairs, selector1 and selector2, so it can rotate keys without a gap. Both CNAMEs must exist.

How do I find my Microsoft 365 DKIM CNAME values?

In the Defender portal, open the DKIM settings for your domain, or run Get-DkimSigningConfig for the domain in Exchange Online PowerShell. The targets depend on your tenant, so copy them from there.

Should I use -all or ~all with Microsoft 365?

Microsoft recommends -all when you also have DKIM and DMARC. DMARC treats both as an SPF failure.