Set up SPF, DKIM and DMARC for Microsoft 365

What it means

With Microsoft 365, Exchange Online sends your emails. Your domain must show receivers that it trusts Microsoft, with three DNS records:

• SPF lists Microsoft's servers as allowed senders.
• DKIM signs each email with a key linked to your domain.
• DMARC tells receivers what to do with emails that fail, and sends you reports.

If you never enabled DKIM for your custom domain, Microsoft signs with your onmicrosoft.com domain. That signature passes, but it does not match your From address, so it does not help your DMARC.

Why it matters

Gmail, Yahoo and Outlook.com expect SPF and DKIM, and DMARC for bulk senders. Microsoft itself rejects or junks more and more mail that fails these checks.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. SPF, DKIM and DMARC should all pass, with DKIM showing d=yourdomain.com.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF and DMARC records.

How to fix it

1. SPF

At your DNS provider, keep a single TXT record starting with v=spf1 on @. For Microsoft 365 alone:

v=spf1 include:spf.protection.outlook.com -all

If other tools send for you, add their includes to the same line. Use ~all while you are not sure the list is complete.

2. DKIM

1. Open the Microsoft Defender portal and go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, then the DKIM tab.
2. Select your custom domain. Microsoft shows two CNAME records, named selector1._domainkey and selector2._domainkey.
3. Copy the exact values shown in the portal: they point to a Microsoft host built from your domain and tenant names. Do not guess them.
4. Add both CNAME records at your DNS provider.
5. Wait until they are visible, then switch Sign messages for this domain with DKIM signatures to enabled.

Two selectors let Microsoft rotate keys without breaking anything. Keep both records forever.

3. DMARC

Add a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Read the reports for a few weeks. Once every real source passes, move to p=quarantine, then p=reject.

4. Do not forget the rest

• Each extra tool (newsletters, invoices, website forms) needs its own SPF include and DKIM setup.
• If you also own the onmicrosoft.com domain only, there is nothing to do there: Microsoft manages it.

Check that it is fixed

• Run the Domain scanner again: one valid SPF record and one DMARC record.
• Send a new test email from Outlook: all three lines should pass, with DKIM signed by your own domain.
• With Delivmail DMARC monitoring in the paid dashboard, you can follow the daily reports before tightening your policy.

Official help: SPF, DKIM and DMARC for Microsoft 365.