Microsoft 365 SPF, DKIM and DMARC

Microsoft 365 sequence

Start with the exact domains that send mail. Microsoft 365 commonly uses include:spf.protection.outlook.com, but a valid organisation record must also account for any other authorised platform and remain a single SPF policy.

Enable DKIM for each custom domain in Microsoft 365 and publish the selector CNAME records Microsoft provides. Test external messages rather than assuming that a DNS record means signing is active. For DMARC, make sure the authenticated SPF or DKIM domain aligns with the visible From domain.

Begin DMARC with reporting, investigate legitimate failures, then strengthen the policy gradually. Hybrid mail flow, third-party gateways, ticketing tools and marketing systems require particular care because they can change the path or signing identity.

Microsoft 365 verification worksheet

1. Separate Microsoft-hosted mail from applications, gateways and third-party senders.
2. Maintain one SPF record within the DNS-lookup limit.
3. Publish Microsoft's selector CNAME records and enable DKIM for every custom sending domain.
4. Test messages after each mail-flow route, including a gateway or hybrid system.
5. Use DMARC aggregate evidence to correct alignment before increasing enforcement.

Common incomplete setup

A tenant can show DKIM configuration while a particular custom domain or route is not signing as expected. Verify received headers, not only administration screens.