Microsoft 365 · SPF, DKIM, and DMARC
DMARC for Microsoft 365: the safe sequence.
A custom Microsoft 365 domain needs more than the default configuration. Publish the tenant-specific DKIM targets, account for external senders, and increase DMARC enforcement only after reviewing real reports.
Reviewed: July 19, 2026 · Primary sources below
Inventory every sender for the domain
List Exchange Online, newsletter tools, CRM, billing software, ticketing, multifunction devices, website forms, and providers. Microsoft 365 does not automatically know every external service using your From domain.
Consolidate SPF into one record
Use the example only when Microsoft 365 is the sole sender. Additional services belong in the existing policy or need aligned DKIM. Multiple SPF records are invalid, and every include must fit within the lookup limit.
v=spf1 include:spf.protection.outlook.com -allCopy both DKIM CNAMEs from Microsoft 365
In the Defender portal, open Email & collaboration, Policies & rules, Threat policies, Email authentication settings, then DKIM. Select the domain and copy both displayed targets. They are tenant-specific; do not copy values from a blog.
selector1._domainkey + selector2._domainkeyEnable DKIM and test a delivered message
Publish both CNAMEs at the DNS host, wait for detection, and enable signing in the Defender portal. Send an external test and verify that DKIM passes with a d= domain aligned to the visible From address.
Start DMARC at the DNS host
For a custom domain, publish DMARC with the DNS provider, not in the Microsoft 365 portal. Start with p=none and an aggregate-report mailbox so missing legitimate sources remain visible without immediate rejection.
v=DMARC1; p=none; rua=mailto:dmarc@example.comMove from monitoring to enforcement
Fix all legitimate alignment failures first. Microsoft recommends a gradual rollout; percentage-based enforcement can control the transition. Keep reviewing reports after every change.
Important
Never copy sample CNAME targets blindly.
Microsoft introduced an updated DKIM target format for newer domains with a dynamic partition component. The Defender portal value or Get-DkimSigningConfig is the source of truth. A plausible-looking but wrong target leaves signing disabled.
If you need continuous monitoring
See who really sends in your name.
DMARCTrust is an external platform for DMARC reports, alerts, and sender inventory. Its free evaluation tier is limited to one domain; paid business plans start at $19/month for two domains. The MX Audit score remains independent.
Where do I publish DMARC for Microsoft 365?
Publish a TXT record at _dmarc with the DNS host or registrar. Microsoft 365 does not provide a separate DMARC policy-management portal for active custom domains.
Why are there two DKIM CNAMEs?
Microsoft uses two selectors. One signs currently while the second supports future key rotation without inventing a new DNS structure.
Can I publish p=reject immediately?
Only when every legitimate source reliably passes aligned SPF or DKIM. Microsoft recommends a gradual rollout so configuration mistakes do not reject good mail.
Is include:spf.protection.outlook.com enough?
Only when Microsoft 365 is the sole sender. Newsletter, CRM, billing, or support platforms need their own approved SPF mechanism or aligned DKIM.