Microsoft 365: set up SPF, DKIM and DMARC step by step

Add SPF

At your DNS provider, create a TXT record for the main domain (name @ or empty):

v=spf1 include:spf.protection.outlook.com -all

• If you also send through other services (newsletter tool, shop, CRM), add their include: before the -all. All services belong in one record.
• -all demands that everything else be rejected. If you're not sure you know all senders, start with ~all.
• If an SPF record already exists, edit it instead of creating a second one. Two records cause a PermError.

Set up DKIM

With Microsoft 365, DKIM consists of two CNAME records. Microsoft creates two keys so that a key change is possible without downtime.

1. Open the Microsoft Defender portal (security.microsoft.com) and go to Email & collaboration › Policies & rules › Threat policies › Email authentication settings. Menu names change from time to time. If necessary, search for “DKIM”.
2. In the DKIM tab, select your domain.
3. If no keys exist yet, choose Create DKIM keys. The portal then shows you two CNAME records:

The values in the table are examples. Copy your values exactly from the portal. They contain your domain with hyphens instead of dots and the name of your tenant.

4. Create both CNAME records in DNS and wait until they can be resolved (minutes to a few hours).
5. In the portal, turn on Sign messages for this domain with DKIM signatures.

Microsoft signs the default domain yourcompany.onmicrosoft.com itself. For your own domain, you have to do the steps above.

Add DMARC

Create a TXT record for _dmarc, for example to start with:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

With p=none, nothing happens to emails yet, but you receive reports on who sends in your name. Later you tighten it to quarantine and reject. The DMARC generator creates the record, and the article Reading DMARC reports explains the next steps.

Check everything

1. Check the records with the SPF checker, the DKIM checker (selectors selector1 and selector2) and the DMARC checker.
2. Then send a real email from Outlook to a Postwacht test address. The report shows SPF, DKIM and DMARC from the recipient's point of view.

Typical mistakes

• “CNAME record not found” when enabling: DNS hasn't updated yet. Wait and try again.
• Doubled domain name: some DNS interfaces append the domain automatically. Then only enter selector1._domainkey, not the full name.
• Two SPF records: an old record from a previous provider often stays. Merge both.
• Mail through third-party services fails DMARC: newsletter tools need their own DKIM for your domain. Set this up at the service.