Guide

How to set up SPF, DKIM, and DMARC for Microsoft 365

Microsoft 365 gives you the tools to authenticate your email, but the setup is scattered across multiple dashboards. Here is a step-by-step guide to get all three protocols configured correctly.

Check your Microsoft 365 setup in seconds

The free InboxProof audit runs a 7-point check (MX, SPF, DKIM, DMARC, TLS, PTR, and IP reputation) and returns a 0-100 score with a plain-English fix list. No signup.

Run the free check

Step 1: Enable DKIM in Microsoft 365

DKIM signs your email with a private key, proving it was sent by you. Microsoft 365 has DKIM available, but you need to enable it.

Go to the Microsoft 365 Admin center (admin.microsoft.com).
Navigate to Settings → Mail → Domain.
Click Set up email authentication.
Under "DKIM," click Enable DKIM.
Copy the two TXT records Microsoft generates and add them to your DNS.

Microsoft uses a different DKIM selector than Google, so make sure you add the exact records it generates.

Step 2: Configure SPF

SPF tells receiving servers which IPs are allowed to send email on behalf of your domain. For Microsoft 365, the SPF record should include Microsoft's sending services.

Add this TXT record to your DNS:

v=spf1 include:spf.protection.outlook.com -all

If you use other sending services (e.g., a marketing tool), add their include: entries. Keep the total DNS lookups under 10.

Step 3: Publish a DMARC record

DMARC ties SPF and DKIM together and tells receivers what to do with unauthenticated email. Start with a monitoring policy:

v=DMARC1 p=none rua=mailto:dmarc-reports@yourdomain.com

Add this as a TXT record at _dmarc.yourdomain.com. After a few weeks of monitoring, move to p=quarantine, then p=reject.

Step 4: Verify the setup

Run the free InboxProof audit to confirm all three protocols are configured correctly. The audit checks:

SPF record exists and is valid
DKIM key is published and strong
DMARC record exists with a reporting address
Alignment between your "From" domain and the SPF/DKIM domains

Common pitfalls

SPF record too long

If you include many services, you may exceed the 10-DNS-lookup limit. Use ip4: or ip6: mechanisms instead of include: where possible.

DKIM selector mismatch

Make sure the DKIM selector in your DNS matches the one in Microsoft 365. If they do not match, DKIM will fail.

DMARC domain mismatch

The DMARC record must be at _dmarc.yourdomain.com, not at the root. If it is in the wrong place, it will not be found.

Verify your Microsoft 365 setup

Run the free audit and see if your SPF, DKIM, and DMARC are configured correctly.

Run a free audit

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →