Patchkit

Setup guide

Microsoft 365: SPF, DKIM and DMARC

Exchange Online mailboxes. Microsoft needs an SPF include and two DKIM CNAME records that point to your tenant.

DNS records to add

TXTHost@
v=spf1 include:spf.protection.outlook.com -all

SPF: authorizes Exchange Online

CNAMEHostselector1._domainkey
<selector1 target shown in Microsoft Defender portal → Email authentication settings → DKIM>Get this value from your provider's dashboard.

DKIM key 1

CNAMEHostselector2._domainkey
<selector2 target shown in the same page>Get this value from your provider's dashboard.

DKIM key 2 (used during rotation)

TXTHost_dmarc
v=DMARC1; p=none; rua=mailto:<your report address>Get this value from your provider's dashboard.

DMARC policy and reports

Steps

  1. Add include:spf.protection.outlook.com to your existing SPF record, or create one if you have none.
  2. In the Microsoft Defender portal open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM and select your domain.
  3. Copy the two CNAME targets Microsoft shows, publish them, then turn on Sign messages for this domain with DKIM signatures.
  4. Publish a DMARC record at _dmarc starting with p=none.

Good to know

  • The DKIM CNAME targets are unique to your tenant. Copy them from the portal, never from another company's setup.

Adding records at your DNS host

Cloudflare · Namecheap · GoDaddy · Amazon Route 53

Check your setup

After publishing, run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Microsoft 365 documentation.