Email authentication
Microsoft 365: SPF, DKIM and DMARC
The records Microsoft 365 documents for sending as your own domain. Each line links to Microsoft 365's documentation; checked on 2026-10-19.
| SPF include | include:spf.protection.outlook.com, e.g. "v=spf1 include:spf.protection.outlook.com -all" learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure |
|---|---|
| DKIM | Two CNAME records, selector1._domainkey and selector2._domainkey, pointing at the values shown in the Microsoft Defender portal; then enable DKIM signing for the domain learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure |
| DKIM selectors | selector1 and selector2 (Microsoft rotates between them) learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure |
| DMARC | A TXT record at _dmarc.<domain>; Microsoft recommends starting with p=none and moving to quarantine or reject learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure |
| Default domain | The *.onmicrosoft.com domain is signed by Microsoft automatically; custom domains need their own DKIM records learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure |
Checked against Microsoft 365's documentation on 2026-10-19. Providers change their instructions; the linked page is the authority.
DMARC, whichever provider you use
- Publish one TXT record at
_dmarc.yourdomain.com, starting withv=DMARC1; p=none; rua=mailto:…to collect reports. - When reports show only your own senders, move to
p=quarantine, thenp=reject. - DMARC passes when SPF or DKIM passes and aligns with the From domain, so sign with your own domain.
Check your domain in a few seconds
SPF, DKIM, DMARC and MX, with what to fix. Free, nothing stored.