DMARC, SPF and DKIM for Microsoft 365

Last reviewed 26 October 2026 · Kastro

To protect a domain that uses Microsoft 365 you need three things: the SPF record v=spf1 include:spf.protection.outlook.com -all, two DKIM CNAME records (selector1 and selector2) shown in Microsoft Defender, and a DMARC record at _dmarc. Start DMARC at p=none, then move to p=quarantine and finally p=reject once all your mail passes.

1. SPF: say who may send

Microsoft recommends -all for domains that only send through Microsoft 365, when DKIM and DMARC are also set up.

TXTName@Valuev=spf1 include:spf.protection.outlook.com -all

@ means the domain itself. Some DNS hosts want the name field left empty.

If other services also send email as your domain, such as invoicing or newsletters, add them to the same record. A domain may only have one SPF record.

2. DKIM: turn on signing

  1. Open security.microsoft.com/authentication and choose the DKIM tab.
  2. Click your domain. Microsoft shows two CNAME records to publish.
  3. Add both at your DNS host. Put only the host part in the name field, for example selector1._domainkey.
  4. Return to Defender and switch on “Sign messages for this domain with DKIM signatures”.
CNAMENameselector1._domainkeyValue(the value Microsoft shows)
CNAMENameselector2._domainkeyValue(the value Microsoft shows)

The values are unique to each domain, so copy them straight from Defender. If your DNS is at Cloudflare, set both records to “DNS only”.

3. DMARC: start in monitoring mode

p=none blocks nothing. It is a safe first stage while you confirm all legitimate mail passes.

TXTName_dmarcValuev=DMARC1; p=none;

4. Tighten DMARC in stages

Send a test email from everything that sends as your domain: normal email, invoicing, web shop, newsletters and web forms. When everything arrives normally, change to p=quarantine. After a week or two with no problems, move to p=reject.

TXTName_dmarcValuev=DMARC1; p=quarantine;
TXTName_dmarcValuev=DMARC1; p=reject;

Common questions

Should I use -all or ~all for Microsoft 365?

Microsoft recommends -all when DKIM and DMARC are also set up, because DMARC can then act on mail that fails SPF and has no DKIM signature.

Why can't Microsoft find my CNAME records?

Usually the full name was entered in the host field so the domain is repeated, or the Cloudflare proxy is on. Use only selector1._domainkey and selector2._domainkey and set them to DNS only. DNS changes can take up to 48 hours.

How long does this take?

The records take minutes. Then allow a week or two on p=none and p=quarantine before moving to p=reject.

Sources