SPF, DKIM and DMARC for Microsoft 365

Microsoft 365 needs three records to authenticate the mail it sends for your domain: SPF so receivers know Microsoft’s servers may send for you, DKIM so each message carries your signature, and DMARC to tie them to your From: address. Since 5 May 2025, Outlook.com rejects mail from domains that send over 5,000 messages a day to its consumer mailboxes (outlook.com, hotmail.com, live.com) unless SPF, DKIM and DMARC pass, with error 550 5.7.515 (Microsoft, April 2025; see Sources below).

1. SPF

Publish one SPF TXT record at the root of your domain that includes Microsoft. If other services also send as your domain (a CRM, a newsletter tool), add their includes to the same record — never publish two SPF records.

TXT @

v=spf1 include:spf.protection.outlook.com -all

Use ~all while you are still discovering senders.

2. DKIM

In the Microsoft Defender portal, open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, select your domain and copy the two CNAME records it shows.

Publish both CNAMEs exactly as shown (the targets are specific to your tenant), wait for DNS, then switch signing on in the same screen.

CNAME selector1._domainkey

(target shown in Defender for selector1)

Example only: selector1-contoso-com._domainkey.contoso.onmicrosoft.com. Formats vary by tenant, so copy the real values from the admin center.

CNAME selector2._domainkey

(target shown in Defender for selector2)

Example only: selector2-contoso-com._domainkey.contoso.onmicrosoft.com. Formats vary by tenant, so copy the real values from the admin center.

3. DMARC

Start in monitoring mode with a report address, read the reports until every legitimate sender passes aligned SPF or DKIM, then move to quarantine and finally reject.

TXT _dmarc

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

ProbeKit accounts get a hosted rua address with dashboards.

MX and autodiscover

Microsoft 365 shows the exact MX and autodiscover values for your domain in the admin center under Settings → Domains. Copy them from there rather than from a guide.

MX @

(value shown in the admin center, priority 0)

Example only: contoso-com.mail.protection.outlook.com. Formats vary by tenant, so copy the real values from the admin center.

Check your setup

Sources

Outlook.com requires SPF, DKIM and DMARC from domains sending over 5,000 messages a day to its consumer mailboxes, enforced from 5 May 2025 by rejecting with 550 5.7.515. Microsoft Community Hub, Outlook blog: “Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders” — published 2 April 2025, updated before enforcement began on 5 May 2025; checked 14 October 2026.

Other provider: SPF, DKIM and DMARC for Google Workspace