DMARC for mailbox providers
How do I set up DMARC for Microsoft 365?
Microsoft 365 needs one SPF include plus two DKIM CNAME records on each custom domain. Until DKIM is enabled for that domain, its mail is not signed with your domain.
The DNS records for Microsoft 365
SPF: TXT on each custom domain that sends
v=spf1 include:spf.protection.outlook.com -allThis is for commercial and GCC tenants. GCC High and DoD use include:spf.protection.office365.us, and 21Vianet uses include:spf.protection.partner.outlook.cn. Microsoft recommends -all.
DKIM selector: selector1 and selector2
selector1._domainkey CNAME selector1-<CustomDomainWithDashes>._domainkey.<InitialDomainPrefix>.<DynamicPartitionCharacter>-v1.dkim.mail.microsoft
selector2._domainkey CNAME selector2-<CustomDomainWithDashes>._domainkey.<InitialDomainPrefix>.<DynamicPartitionCharacter>-v1.dkim.mail.microsoftThis target format applies to custom domains added since May 2025. Existing domains keep the older selector1-<domain>._domainkey.<tenant>.onmicrosoft.com form. Copy the exact values from the Defender portal or Get-DkimSigningConfig.
Values in angle brackets are specific to your account. Copy the real ones from Microsoft 365 rather than from this page.
Alignment caveats
- ✓Each subdomain that sends needs its own SPF record. The parent domain's record does not cover it.
- ✓Microsoft recommends moving bulk mail services to a subdomain, which protects your main domain's reputation and gives that service its own 10-lookup budget.
- ✓Microsoft advises against flattening include:spf.protection.outlook.com because its sending IP addresses change often.
From p=none to p=reject with Microsoft 365
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Enable DKIM on every custom domain first, including ones that send little mail. DMARC needs an aligned pass, and DKIM usually survives forwarding where SPF does not.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from Microsoft 365's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how Microsoft 365 really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does Microsoft 365 need?
v=spf1 include:spf.protection.outlook.com -all, published as: TXT on each custom domain that sends. This is for commercial and GCC tenants. GCC High and DoD use include:spf.protection.office365.us, and 21Vianet uses include:spf.protection.partner.outlook.cn. Microsoft recommends -all.
What DKIM selector does Microsoft 365 use?
selector1 and selector2. This target format applies to custom domains added since May 2025. Existing domains keep the older selector1-<domain>._domainkey.<tenant>.onmicrosoft.com form. Copy the exact values from the Defender portal or Get-DkimSigningConfig.
Will Microsoft 365 mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Each subdomain that sends needs its own SPF record. The parent domain's record does not cover it.
How do I reach p=reject with Microsoft 365?
Start at p=none with a rua address, finish the Microsoft 365 setup, then read your reports. Enable DKIM on every custom domain first, including ones that send little mail. DMARC needs an aligned pass, and DKIM usually survives forwarding where SPF does not. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
