SPF, DKIM & DMARC for Microsoft 365

SPF

Add a TXT record at your root domain:

Already have an SPF record for something else? Add include:spf.protection.outlook.com to it instead of creating a second record — only one is allowed per domain.

DKIM — this one works differently than most providers

Most providers publish DKIM as a TXT record. Microsoft 365 uses two CNAME records instead, and — easy to miss — it actually auto-signs your mail using a default onmicrosoft.com selector even if you never touch this. To sign with your own domain's selectors (what mailbox providers expect to see), you need to:

• Add two CNAME records at your DNS host:
  selector1._domainkey.yourdomain.com → selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
selector2._domainkey.yourdomain.com → selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
  (replace yourdomain-com and yourtenant with your actual domain and tenant name — find the exact values in the admin portal in the next step, they're specific to your account)
• Microsoft 365 Defender portal → Email & collaboration → Policies & rules → Threat policies → DKIM → select your domain → toggle Enable

Until DKIM is explicitly enabled there, the CNAME records alone don't do anything.

DMARC

Not specific to Microsoft 365 — the same record works everywhere. Use the DMARC record generator to build yours.