Guides › Providers
SPF, DKIM and DMARC for Microsoft 365
SPF
Host: @ Type: TXT Value: v=spf1 include:spf.protection.outlook.com -all
If you already have an SPF record, add the include to it rather than creating a second record. Two SPF records make SPF fail (see merging SPF records).
DKIM
Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey, that point to keys Microsoft hosts and rotates. Copy the exact targets from the Microsoft Defender portal (Email & collaboration › Policies › Email authentication settings › DKIM), publish both, then toggle Sign messages for this domain with DKIM signatures on. Older tenants use targets like selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com; newer tenants use a different format, so always copy from the portal.
DMARC
DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.
Notes
Without custom DKIM, Microsoft signs with your onmicrosoft.com domain, which doesn't align for DMARC.
Use the checker to confirm all three records. It detects Microsoft 365's DKIM selector automatically if it's a standard one.