Microsoft 365 Email Authentication: SPF, DKIM & DMARC Setup Guide

Microsoft 365 has a quirk that catches out an enormous number of domains: out of the box, your mail is signed with Microsoft’s own domain, not yours. Until you explicitly enable DKIM for your custom domain, DMARC alignment fails — even though everything looks like it’s working, and mail mostly arrives.

Then you publish p=rejectand things break. Here’s the correct order. The equivalent guide for Google is Google Workspace email authentication setup.

Step 1: SPF

Microsoft 365 needs one include. Publish a TXT record at your root domain:

v=spf1 include:spf.protection.outlook.com -all

If other services also send as your domain — a CRM, a marketing platform, an invoicing tool — they go in the same record. You may only have one SPF record per domain; see why two SPF records break authentication.

On -all vs ~all: -all(hard fail) is correct once you’re confident every sender is listed. If you’re not yet sure, start with ~all(soft fail) and tighten later. And watch the 10-lookup limit — each include costs at least one lookup, and exceeding ten invalidates the whole record. See the 10-lookup limit explained.

Step 2: DKIM (the part everyone gets wrong)

Microsoft uses two selectors, selector1 and selector2, so it can rotate keys without downtime. You publish CNAMEs, not TXT records — Microsoft hosts the actual keys.

You need two values first:

• Your initial domain — the yourtenant.onmicrosoft.com address created when the tenant was set up.
• Your domain GUID— this is just your domain with dots replaced by hyphens. It’s the first part of your MX record: if your MX is contoso-com.mail.protection.outlook.com, the GUID is contoso-com.

Then publish two CNAMEs:

Host:  selector1._domainkey
Value: selector1-contoso-com._domainkey.yourtenant.onmicrosoft.com

Host:  selector2._domainkey
Value: selector2-contoso-com._domainkey.yourtenant.onmicrosoft.com

Now the step people skip:publishing the CNAMEs is not enough. You must enable signing in the Microsoft Defender portal — go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, select your domain, and toggle signing on. Until that toggle is on, Microsoft signs as onmicrosoft.com and DMARC alignment fails.

If the toggle throws an error, the CNAMEs haven’t propagated yet. Wait and retry — it can take a few hours.

Step 3: DMARC

Start in monitoring mode. Publish a TXT record:

Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The record goes at _dmarc.yourdomain.com, not the root domain — the single most common DMARC mistake. Generate one with the free DMARC record generator.

Leave it at p=none for a few weeks, read the reports to confirm every legitimate sender aligns, then tighten. See when to use p=none, quarantine, or reject.

Verify it actually worked

Don’t trust the admin portal — check the wire. Send a message to an external address, open the raw headers, and find DKIM-Signature. You want:

d=yourdomain.com; s=selector1

If d= shows yourtenant.onmicrosoft.com, signing isn’t enabled for your custom domain yet — go back to step 2. You can also confirm from outside with the free email check.

Common Microsoft 365 failures

• CNAMEs published, signing never enabled.By far the most common. The DNS looks perfect and DKIM still isn’t yours.
• DNS provider appends the domain twice. Some registrars turn selector1._domainkey into selector1._domainkey.yourdomain.com.yourdomain.com. Check what was actually saved.
• Only selector1 published. Both are required. When Microsoft rotates to selector2, signing silently breaks.
• Hybrid or third-party relay.If mail routes through an on-prem server or a filtering gateway before Microsoft, signing behaviour changes — verify headers from a real send.
• Sub-domains forgotten. A subdomain sending mail needs its own SPF and DKIM, or a DMARC policy that accounts for it.

Keeping it working

Microsoft rotates DKIM keys, tenants get migrated, and someone eventually edits DNS without telling you. All three break signing quietly — mail keeps flowing to lenient receivers, then Gmail starts rejecting. Zeqo Mail re-checks SPF, DKIM and DMARC on a schedule and alerts you when a record changes, which is the difference between finding out today and finding out at the next campaign.

Next: free DKIM checker · what is my DKIM selector?