Skip to content

How to set up DMARC for Microsoft 365

By Ash, Founder, HosteazePublished 2 min read

The short answer

Add an SPF record with include:spf.protection.outlook.com, then create the two DKIM CNAME records Microsoft gives you and switch on DKIM signing in the Defender portal. Once both pass, add a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto: and a reporting address, and tighten the policy later.

A brass padlock with two keys beside it on a white background
Credit: PublicDomainPictures via Pixabay

Microsoft 365 doesn't switch on DKIM for your own domain by default, which surprises a lot of people. Until you do, your email relies on SPF alone, and DMARC has much less to work with. So this guide does the three records in order: SPF, DKIM, then DMARC.

Step 1: Check your SPF record

Your domain needs one TXT record starting v=spf1 that includes Microsoft:

v=spf1 include:spf.protection.outlook.com -all

If you already have an SPF record for other services, add the include to it rather than creating a second record. Two SPF records break SPF entirely.

Step 2: Turn on DKIM

  1. Go to the DKIM tab of the Email authentication settings page in the Microsoft Defender portal, at security.microsoft.com/authentication.
  2. Select your domain. The panel shows two CNAME records, with hosts selector1._domainkey and selector2._domainkey, and long values ending in dkim.mail.microsoft.
  3. Add both CNAME records to your domain's DNS exactly as shown.
  4. Wait a few minutes for Microsoft to detect them, then return to the domain and switch on Sign messages for this domain with DKIM signatures.

Copy the values from the portal rather than from a guide. They include your tenant's details, so nobody else's will work. For what DKIM is doing behind the scenes, see the glossary.

Step 3: Add the DMARC record

  1. Create a mailbox or shared mailbox to receive reports, such as dmarc@yourdomain.co.uk.
  2. In your domain's DNS, add a TXT record with the host _dmarc.
  3. Set the value to v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk.
  4. Save, then check your domain has DMARC once the change has spread.

How do I check it's all working?

Send an email from Outlook to a personal Gmail address, open it, choose Show original, and check SPF, DKIM and DMARC all say PASS. Repeat for every other service that sends as your domain, such as your newsletter tool, invoicing software or website forms. Anything that fails needs adding to SPF or its own DKIM record before you tighten the policy.

When should I move to quarantine or reject?

When a few weeks of DMARC reports show every legitimate sender passing. Move to p=quarantine, then p=reject. DMARC p=none vs quarantine vs reject has a safe order to follow, and how to set up SPF, DKIM and DMARC covers the wider setup for other providers.

Step by step

  1. 1.Check SPF

    Make sure your domain has one SPF record that includes include:spf.protection.outlook.com.

  2. 2.Add the DKIM CNAME records

    Copy the selector1 and selector2 CNAME values for your domain from the DKIM tab in the Microsoft Defender portal and add them to your DNS.

  3. 3.Turn on DKIM signing

    Back on the DKIM tab, switch on "Sign messages for this domain with DKIM signatures".

  4. 4.Add the DMARC record

    Create a TXT record with the host _dmarc and the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk.

  5. 5.Read reports and tighten

    Review the reports for a few weeks, fix any service that fails, then move to p=quarantine and later p=reject.

Frequently asked questions

Do I need DMARC for my onmicrosoft.com domain?

Only if you send email from it. Microsoft sets up SPF and DKIM for onmicrosoft.com addresses automatically, and you add DMARC for them in the Microsoft 365 admin center rather than in your own DNS.

Why does Microsoft use CNAME records for DKIM instead of TXT?

So it can rotate the keys for you. Your CNAME records point at Microsoft's own records, and Microsoft changes the keys behind them without you editing DNS again.

Is ~all or -all better for Microsoft 365?

Microsoft's own example uses -all. Either works once DMARC is in place; ~all is a gentler choice while you're still finding every service that sends as your domain.

Sources

  1. Microsoft, Set up DMARC to validate the From address domain
  2. Microsoft, How to use DKIM for email in your custom domain
  3. Microsoft, Set up SPF to identify valid email sources
  4. RFC 7489, DMARC

Keep reading

An old iron key in a rustic wooden door lockTutorialHow to set up DMARC for Google WorkspaceFirst make sure SPF includes _spf.google.com and DKIM is switched on in the Google Admin console. Wait 48 hours, then add a TXT record at _dmarc on your domain with the value v=DMARC1; p=none; rua=mailto: followed by a reporting address. Read the reports for a few weeks before moving to quarantine.Email and domains · 15 October 2026A tall stack of envelopes and letters seen side on, the scale bulk senders work atQuestionGoogle, Yahoo and Outlook bulk sender rules, explainedGmail, Yahoo and Outlook.com require anyone sending around 5,000 or more emails a day to them to pass SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam complaints below 0.3%. Every sender, whatever the volume, needs at least SPF or DKIM, valid reverse DNS and a low spam rate.Email and domains · 15 October 2026Red octagonal stop sign against a blue sky, like a mail server refusing a messageQuestionWhat does a 550 email bounce error mean?A 550 error means the receiving mail server permanently refused your email, so it won't try again. The extra code after it gives the reason. 5.1.1 means the address doesn't exist, 5.7.1 means it was blocked as spam or by a policy, and 5.7.26 means your domain's SPF or DKIM authentication failed.Email and domains · 14 October 2026Two stacked cardboard boxes, ready for a move, like your email moving to a new providerTutorialHow to change MX records without losing emailLog in to wherever your domain's DNS is managed, delete the old MX records, and add the new ones your email provider gives you with the exact priority numbers. Lower the TTL a day before if you can. New email reaches the new provider within minutes to hours, so keep the old mailboxes open for a few days.Email and domains · 14 October 2026Wooden arrow-shaped signpost against a blue sky, pointing the wayTutorialHow to point a domain to a websiteYou have two options. Change your domain's nameservers to the ones your host gives you, which hands over all your DNS. Or keep your DNS where it is and add an A record for the root domain plus a CNAME for www. Either way, copy your email records first so your inbox keeps working.Email and domains · 14 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans