Set up SPF, DKIM and DMARC with Microsoft 365

Before you start

Microsoft says it explicitly: there is no Microsoft 365 admin portal or PowerShell cmdlet to manage the SPF and DMARC records of your domain. You create them at your registrar or DNS host, often the same company.

DKIM is a mix: the values are read in the Microsoft security portal (security.microsoft.com), published at the registrar, then signing is turned on in the portal. The domain must already have been added to Microsoft 365.

SPF for Microsoft 365

1. At your registrar or DNS host, open the DNS zone of your domain.
2. Look for an existing SPF record (a TXT record starting with v=spf1). If there is one, edit it to add the Microsoft include. Otherwise, create a TXT record.

Only one SPF record per domain or subdomain: several records cause an SPF error. If other services send on your behalf, their "include" entries go in the same line. Microsoft recommends -all (strict rejection) for its domains, because DKIM and DMARC are also in place.

For prospecting, Microsoft recommends sending bulk emails from a service that is not under your direct control on a subdomain (marketing.yourdomain.com, for example) rather than on the main domain. Each subdomain then has its own SPF.

DKIM for Microsoft 365

1. Open the security.microsoft.com portal, then Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM tab. The labels may vary depending on the language of the portal.
2. Select your domain and try to turn on the signing toggle: an error box shows the values of the two CNAMEs to create. The status changes to "CnameMissing".
3. In the domain details pane, note the "Publish CNAMEs" section and create the two records at your registrar.
4. Wait a few minutes, sometimes longer, then go back to the pane and turn on "Sign messages for this domain with DKIM signatures". The status should change to "Signing DKIM signatures for this domain".

Never build the value by hand: it depends on your initial .onmicrosoft.com domain. Since May 2025, new custom domains use a format that ends in .dkim.mail.microsoft, while older domains keep the old .onmicrosoft.com format, and the two cannot coexist for the same selector. The portal shows the right value for your case.

A PowerShell command also exists to read the values: Get-DkimSigningConfig -Identity yourdomain.com.

DMARC for Microsoft 365

Same principle as SPF: no Microsoft interface, the record is created at your DNS host. SPF and DKIM must be configured, with a DKIM signature on your custom domain for alignment to work.

1. Create a TXT record whose host name is _dmarc (required).
2. Start with p=none and a rua address, and read the reports. Microsoft recommends a gradual approach: p=none, then p=quarantine (with pct in steps of 10, 25, 50, 75 then 100), then p=reject.

Microsoft advises starting with a low-volume subdomain and keeping the parent domain for last. The DMARC of a domain covers its subdomains that do not have their own record.

Good to know: an outbound Microsoft 365 message that fails DMARC at the recipient goes through the "high-risk delivery pool" if your policy is quarantine or reject, with no possibility of override. One more reason to tighten the policy only after checking your sending.

Common mistakes

• Looking for where to set SPF or DMARC in the Microsoft admin center: there is nothing there, everything is done at the registrar.
• Rebuilding the DKIM CNAME values by hand: copy the ones from the portal.
• Forgetting to turn on signing in the portal after creating the CNAMEs: the status stays on CnameMissing or disabled.
• Several v=spf1 lines on the same domain.

Frequently asked questions

Official sources

• Microsoft: set up SPF
• Microsoft: set up DKIM
• Microsoft: set up DMARC

Interfaces and values taken from the official documentation on October 15, 2026. Providers sometimes change their menus: if there is a discrepancy, the official page prevails.

A refusal message to decode?

Once authentication is in place, the remaining refusals have other causes. Each guide explains how to tell them apart.

• Error 550 5.7.1
• Error 550 5.7.26
• Error 550 5.1.1
• Error 421 and 451
• Error 554

Another mail provider?

• Google Workspace