HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Security & compliance

How do we set up SPF, DKIM and DMARC for Microsoft 365?

By Accred Consulting Microsoft 365 Practice | Company facts

Short answer

Publish one SPF record that includes Microsoft 365 and every other service that sends as your domain, turn on DKIM signing for each custom domain in the Microsoft Defender portal, then publish a DMARC record in monitor mode. Read the DMARC reports, fix any legitimate senders that fail, and step the policy up to quarantine and then reject.

Key facts

  • A domain can have only one SPF record, and SPF allows at most 10 DNS lookups.
  • DKIM must be enabled per custom domain; it is not on for custom domains by default.
  • DMARC passes when SPF or DKIM passes and aligns with the visible From domain.
  • Start DMARC at p=none with reporting, then move to quarantine and reject.
  • Domains that never send mail should publish a reject policy and an empty SPF.

How the three records work together

SPF lists the servers allowed to send mail for a domain. DKIM adds a cryptographic signature that proves the message was not altered and came from a key you control. DMARC tells receiving servers what to do when a message claiming to be from your domain fails both, and sends you reports about who is sending as you.

Large mailbox providers now expect bulk senders to have SPF, DKIM and DMARC in place, and missing records increasingly mean messages land in junk or are rejected. Beyond deliverability, DMARC at enforcement is one of the most effective controls against exact-domain spoofing used in invoice and payment fraud.

Step 1: SPF

Publish a single TXT record at the root of the domain. For a domain that only sends through Exchange Online, the record is v=spf1 include:spf.protection.outlook.com -all. Add an include for every other service that sends as your domain, such as a marketing platform, CRM, help desk or payroll system.

  • Merge multiple SPF records into one; two records cause SPF to fail.
  • Count DNS lookups; each include, a and mx mechanism counts toward the limit of 10.
  • Use -all (hard fail) once you are confident the list is complete; ~all (soft fail) is common during discovery.
  • Move bulk senders to a subdomain such as news.example.com to keep the main record short.

Step 2: DKIM

In the Microsoft Defender portal, go to Email and collaboration policies, then Email authentication settings, and open the DKIM tab. For each custom domain, the portal shows two CNAME records, for selector1 and selector2, with the exact target values for your tenant. Publish both in DNS, wait for them to resolve, then enable signing.

The onmicrosoft.com domain is signed automatically, but that does not help your custom domain pass DMARC alignment. Third-party senders need their own DKIM setup, usually by publishing CNAME or TXT records they provide, so their mail is signed with your domain.

Step 3: DMARC, in stages

Publish a TXT record at _dmarc.example.com. Start with v=DMARC1; p=none; rua=mailto:[email protected] so you get aggregate reports without affecting delivery. Use a DMARC reporting service or a dedicated mailbox with a parser, because raw reports are XML and hard to read at volume.

StagePolicyMove on when
Monitorp=noneAll legitimate senders are identified and pass SPF or DKIM with alignment
Partial enforcementp=quarantineReports show no legitimate mail being quarantined
Full enforcementp=rejectSteady state; keep reviewing reports for new senders

Common problems and how to avoid them

Most DMARC rollouts stall because of unknown senders: an old scanner, a website contact form, a finance system sending invoices, or a vendor sending on your behalf. The aggregate reports reveal them. Each one needs SPF, DKIM or both set up correctly, or it needs to send from a subdomain.

Forwarding and mailing lists can break SPF, which is why DKIM matters. Exchange Online supports ARC, and you can add trusted ARC sealers for services that modify mail in transit. Also cover parked and unused domains: publish v=spf1 -all and a DMARC reject policy so they cannot be used for spoofing.

How Accred Consulting approaches it

Accred Consulting sets up email authentication as a short, fixed-scope project or as part of a wider security engagement. Discovery inventories every domain and every system that sends mail, which is where most surprises surface. The proposal sets a clear scope, fixed price and timeline. US-based specialists publish SPF and DKIM, configure DMARC reporting, work through the reports with your team and vendors, and move each domain to enforcement in stages. Handover includes a sender inventory, the DNS records, documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

For a single domain with few senders, a few weeks. For organizations with many domains and third-party senders, it can take a few months, because each sender has to be found and fixed and you want several weeks of clean reports before each step. The schedule is set after the sender inventory.
No. DMARC stops attackers from sending mail that uses your exact domain in the From address. It does not stop look-alike domains, display-name spoofing or compromised vendor mailboxes. Pair it with Defender for Office 365 anti-phishing, impersonation protection and user training.
Yes. Unused and parked domains are attractive for spoofing because nobody is watching them. Publish an SPF record of v=spf1 -all, a DMARC record with p=reject, and no MX record if the domain does not receive mail. Review the list of domains you own once a year.

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.

Book a free consultation