SPF, DKIM and DMARC in Microsoft 365

What to publish

Step by step

1. At your DNS provider, publish the SPF record (or add include:spf.protection.outlook.com to the one you have).
2. In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM tab (shortcut: security.microsoft.com/authentication?viewid=DKIM).
3. Open your domain and press “Create DKIM keys”. The portal shows you the two CNAMEs: publish them as they are in your DNS.
4. Once the CNAMEs resolve (it can take a while), go back to the domain and turn on “Sign messages for this domain with DKIM signatures”.
5. Publish DMARC at p=none with an rua mailbox and read the reports for a few weeks before raising the policy.

Usual mistakes

• Two SPF records on the same domain: receivers treat both as invalid. Merge them into one.
• include= instead of include:, a space after the colon or a trailing dot after the domain.
• Copying Microsoft’s IPs instead of the include:: they change, and Microsoft asks you not to “flatten” it.
• Publishing the DKIM CNAMEs and forgetting to turn signing on in the portal.
• If your DNS is on Cloudflare, the DKIM CNAMEs must be “DNS only” (grey cloud), not proxied.

Towards p=reject

DMARC at p=none only watches. The reports (rua) show who sends on your behalf; once all your legitimate mail passes aligned SPF or DKIM, move to quarantine and then to reject. That way, nobody can use your domain to send forged mail.

• The auditor gives you the phased plan with the exact records
• Analyze DMARC reports in your browser, without uploading them
• We alert you if your domain’s protection changes