Setup guide
Microsoft 365: SPF, DKIM and DMARC
Exchange Online mailboxes. Microsoft needs an SPF include and two DKIM CNAME records that point to your tenant.
By Ahmet Karaca · Updated · Checked against Microsoft 365 documentation on
DNS records to add
@v=spf1 include:spf.protection.outlook.com -allSPF: authorizes Exchange Online
selector1._domainkey<selector1 target shown in Microsoft Defender portal → Email authentication settings → DKIM>Get this value from your provider's dashboard.DKIM key 1
selector2._domainkey<selector2 target shown in the same page>Get this value from your provider's dashboard.DKIM key 2 (used during rotation)
_dmarcv=DMARC1; p=none; rua=mailto:<your report address>Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.
DMARC policy and reports
Steps
- Add include:spf.protection.outlook.com to your existing SPF record, or create one if you have none.
- In the Microsoft Defender portal open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM and select your domain.
- Copy the two CNAME targets Microsoft shows, publish them, then turn on Sign messages for this domain with DKIM signatures.
- Publish a DMARC record at _dmarc starting with p=none.
Common mistakes
- Until you enable DKIM for a custom domain, Microsoft 365 doesn't sign that domain's outbound mail with its own DKIM key, so DMARC can only pass through SPF.
- Turning on the DKIM toggle before both CNAMEs resolve leaves the domain in CnameMissing status with signing still disabled. Microsoft 365 can take a few minutes or longer to detect new CNAMEs.
- Flattening include:spf.protection.outlook.com into IP addresses breaks SPF over time, because Microsoft's sending infrastructure uses dynamic IP addresses that change frequently.
- Copying include:spf.protection.outlook.com into a GCC High, DoD or 21Vianet tenant authorizes the wrong servers. Those clouds use spf.protection.office365.us and spf.protection.partner.outlook.cn instead.
Good to know
- The DKIM CNAME targets are unique to your tenant. Copy them from the portal, never from another company's setup.
Frequently asked questions
Do I need SPF or DKIM records for my onmicrosoft.com domain?
No. Microsoft maintains the SPF record for *.onmicrosoft.com and DKIM-signs mail from it automatically. You can't modify that SPF record.
When does the other Microsoft 365 selector take over after I rotate DKIM keys?
Four days (96 hours) after the rotation. Until then Microsoft 365 keeps signing with the current selector.
Can Microsoft 365 use 2048-bit DKIM keys?
Yes, through Exchange Online PowerShell with the KeySize parameter. When you switch from 1024 by rotating, the 2048-bit size applies to the next active selector first and to the other selector on the following rotation.
Does a subdomain need its own SPF and DKIM setup in Microsoft 365?
Yes. Each subdomain you send from needs its own SPF TXT record and its own DKIM configuration, while undefined subdomains inherit the parent domain's DMARC settings.
What should I publish for domains that never send email?
Microsoft recommends v=spf1 -all as the SPF record for parked domains and publishing no DKIM records for them at all.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Microsoft 365 documentation.
Check your Microsoft 365 setup
Or open the SPF checker, DKIM checker or DMARC checker directly.