Set up SPF, DKIM and DMARC on Microsoft 365

If your business uses Microsoft 365 for email, here is how to enable the three anti-spoofing protections, step by step.

1. SPF — allow Microsoft's servers

In your DNS zone, add (or complete) a TXT record on your domain:

v=spf1 include:spf.protection.outlook.com -all

If you also send email through other services (newsletter, CRM), add their "include" entries before the -all.

2. DKIM — sign your emails

In the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → DKIM. Select your domain, then enable DKIM. Microsoft gives you two CNAME records (selector1._domainkey and selector2._domainkey) to add to your DNS, then you turn on signing.

3. DMARC — block spoofers

Add a TXT record on _dmarc.yourdomain.com. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

After a few weeks with no issues, move to p=quarantine, then p=reject for maximum protection.

The 5 most common traps on Microsoft 365

1. DKIM shown as “enabled” but never signing. Adding the two CNAMEs is not enough: you must go back into the portal and flip the Sign messages for this domain switch. Until you do, your email leaves unsigned.
2. Two SPF records. If an SPF record already existed (old host, website), you now have two — and the standard says a domain with two SPF records is invalid: servers then ignore both. Merge them into one, with every include in a row.
3. The 10-DNS-lookup limit. Every include costs a lookup, and some trigger several in cascade. Past 10, your SPF fails silently (a “permerror”) and protects nothing. Our SPF checker counts those lookups for you.
4. Jumping to p=reject too fast. If a service (newsletter, accounting software, website form) sends in your name without being authorized, its email gets blocked overnight. Stay at p=none long enough to read your reports, then move up.
5. The forgotten subdomain. A DMARC policy on the root domain covers subdomains by inheritance, but if you publish a different sp=, check it: spoofing often comes through a forgotten subdomain (info., mail.).

How to know it is really active

DNS changes take minutes to hours. Then two checks beat a screenshot of the portal: run our free report (it reads your public records and detects the DKIM selector actually published), then send yourself a real email from your Microsoft 365 mailbox and paste its header into our header analyzer: you will see in black and white whether SPF, DKIM and DMARC pass on the receiving side.

Finally, turn on free monitoring for your domain: a migration, a provider change or a DNS slip can remove these records without anyone noticing — sometimes for months.