Microsoft 365 Email DNS Setup: SPF, DKIM and DMARC

Introduction

Microsoft 365 uses DNS records to route inbound email to Exchange Online and authenticate outbound email from your domain. MX records control where incoming mail is delivered, while SPF, DKIM and DMARC help receiving mail servers verify that outgoing messages are authorized.

A correct Microsoft 365 setup usually includes the Microsoft 365 MX record, an SPF record that authorizes Microsoft’s sending infrastructure, DKIM enabled for your custom domain, and a DMARC policy published at _dmarc.yourdomain.com. If old provider records remain active or records are added in the wrong DNS zone, mail routing or authentication can fail.

Quick answer

Microsoft 365 DNS

A typical Microsoft 365 email setup uses several DNS records:

MX records

MX records tell the internet where to deliver incoming email for your domain. For Microsoft 365, the MX record is usually provided in the Microsoft 365 admin center during domain setup.

The exact MX hostname can be domain-specific. Use the value shown in Microsoft 365 admin center instead of copying another domain’s MX record.

• MX Lookup →

SPF

If Microsoft 365 sends mail for your domain, SPF should authorize Microsoft’s sending infrastructure.

v=spf1 include:spf.protection.outlook.com ~all

If you also send mail from other services, such as a CRM, website form, newsletter platform or billing system, do not create separate SPF records. Merge all legitimate senders into one SPF record.

v=spf1 include:spf.protection.outlook.com include:mailservice.example ~all

• SPF When Using Multiple Email Providers →

DKIM

DKIM for Microsoft 365 is configured for the custom domain and usually uses DNS records provided by Microsoft. In many Microsoft 365 setups, DKIM uses selector-based DNS records such as selector1 and selector2.

selector1._domainkey.example.com
selector2._domainkey.example.com

The exact target values should come from Microsoft 365 / Defender admin settings for your domain.

1. 1. Open Microsoft 365 / Defender email authentication settings

   Find DKIM settings for the custom domain.

2. 2. Select the custom domain

   Choose the domain you want to sign outgoing mail for.

3. 3. Review the required DKIM selector records

   Copy the selector hostnames and target values Microsoft provides.

4. 4. Add the required DNS records at the active DNS provider

   Publish the selector records where your domain’s DNS is hosted.

5. 5. Wait until DNS is visible

   Allow DNS propagation before enabling signing.

6. 6. Enable DKIM signing for the domain

   Turn on DKIM signing in Microsoft 365 after DNS is detected.

7. 7. Send a test message and confirm DKIM passes

   Verify real outgoing mail passes DKIM authentication.

DMARC

After SPF and DKIM are configured, add a DMARC record at _dmarc.example.com.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

p=none lets you collect reports without asking receivers to quarantine or reject mail. Move to quarantine or reject only after confirming legitimate Microsoft 365 and third-party senders pass DMARC alignment.

• DMARC for Beginners: Policies, Alignment and Enforcement →

Setup order

1. Step 1: Confirm active DNS provider

   Check nameservers so you know where DNS records must be added.

2. Step 2: Set Microsoft 365 MX

   Route inbound mail to Exchange Online using the MX value shown in Microsoft 365 admin center.

3. Step 3: Add SPF

   Authorize Microsoft 365 with include:spf.protection.outlook.com and merge any other real sending providers.

4. Step 4: Enable DKIM

   Add the required selector records, wait for DNS, then enable DKIM signing for the domain.

5. Step 5: Add DMARC

   Start with p=none and a reporting address.

6. Step 6: Test real messages

   Send mail to external providers and inspect SPF, DKIM and DMARC results.

Why this matters

Microsoft 365 authentication is especially important if your domain also uses newsletters, CRMs, billing systems, website forms, support desks or transactional email tools.

How to check it

Use CheckDomainHealth tools to inspect MX, SPF, DKIM and DMARC records for your domain.

Common problems

How to fix it

1. Step 1: Check active nameservers

   Confirm where DNS is hosted before editing records.

2. Step 2: Verify MX records

   Use MX Lookup to confirm Exchange Online is the active inbound mail destination.

3. Step 3: Fix SPF

   Publish one SPF record that includes Microsoft and any other real sending services.

4. Step 4: Configure DKIM selectors

   Use the selector records shown in Microsoft 365 / Defender admin settings and publish them in DNS.

5. Step 5: Enable DKIM signing

   After DNS is visible, enable DKIM signing for the custom domain.

6. Step 6: Add DMARC monitoring

   Publish a p=none DMARC record and collect reports.

7. Step 7: Test external delivery

   Send messages to external mailboxes and check message headers for SPF, DKIM and DMARC results.

8. Step 8: Review third-party senders

   Authenticate newsletters, CRMs, billing platforms, website forms, helpdesks and transactional tools separately.

DNS examples

v=spf1 include:spf.protection.outlook.com ~all

v=spf1 include:spf.protection.outlook.com include:mailservice.example ~all

selector1._domainkey.example.com
selector2._domainkey.example.com

v=DMARC1; p=none; rua=mailto:dmarc@example.com

dig example.com MX
dig example.com TXT
dig selector1._domainkey.example.com TXT
dig _dmarc.example.com TXT

Other senders

Many domains use Microsoft 365 for mailbox email and other services for newsletters, invoices, CRM messages, support tickets or website forms.

• Does it need an SPF include?
• Does it support custom DKIM?
• Does it align with DMARC?
• Does it use your domain in the visible From address?
• Does it appear in DMARC reports?

Frequently asked questions