Microsoft 365: SPF, DKIM and DMARC setup
Add these records at your DNS host, then check your domain below. The check counts SPF lookups and shows any Microsoft 365 DKIM key it finds.
The rest of the domain
Watch this domain for changes with Sender Guard. Free for 3 domains.
Records for Microsoft 365
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all |
| CNAME | selector1._domainkey | shown in the Microsoft Defender portal under DKIM |
| CNAME | selector2._domainkey | shown in the Microsoft Defender portal under DKIM |
Microsoft 365 signs with two selectors, selector1 and selector2, published as CNAMEs to your tenant. Enable DKIM signing in the Defender portal after both resolve.
DMARC. Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com at _dmarc, read the reports for a few weeks, then move to p=quarantine. Gmail and Yahoo require a DMARC record from bulk senders.
One SPF record only. If you already have one, add the include to it rather than publishing a second record.
Other checks
SPF checker DMARC checker DKIM checker MX lookup Full domain report