Domain Health
Log inGet started

DMARC, SPF and DKIM for Microsoft 365

Microsoft 365 handles your mailboxes, but three records that decide whether your mail is trusted still have to be added by you. Here's how, and a free check to confirm it worked.

Free, no account needed. Checks SPF, DKIM and DMARC together.

Step 1: SPF

Make sure your domain has exactly one SPF record that includes Microsoft:

v=spf1 include:spf.protection.outlook.com -all

If other services also send as you (an accounting package, a website contact form, a newsletter tool), add their include: in the same record. See the SPF checker for the common mistakes.

Step 2: DKIM

  1. Open the Microsoft Defender portal and go to Email authentication settings, then DKIM.
  2. Select your custom domain. Microsoft shows two CNAME records, for selector1 and selector2.
  3. Add both CNAMEs at your DNS host exactly as shown. Wait for them to resolve, sometimes an hour or more.
  4. Back in Defender, turn on signing with DKIM for the domain.

Step 3: DMARC

Add a TXT record with the host name _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.za

Leave it at p=none for a few weeks while reports arrive, then change it to p=quarantine and later p=reject. Until then forged mail is still delivered. The DMARC checker explains each policy.

Step 4: Check it, then keep it checked

Run the free check above once the records are in. Records break quietly when someone changes DNS or moves hosting, so add the domain to Domain Health and you'll get an email the morning something changes.

Common questions

Doesn't Microsoft 365 set up DMARC for me?

Not for your own domain. Microsoft takes care of the yourcompany.onmicrosoft.com address, but for a custom domain like yourcompany.co.za you have to publish the DMARC record yourself, wherever your DNS is hosted.

The admin center says my domain is healthy. Why does your check fail?

The Check health screen in the Microsoft 365 admin center only verifies the records Microsoft needs to route mail to you, such as MX, SPF and autodiscover. It doesn't check whether DKIM is published or whether a DMARC policy exists.

Where do I add these records?

At whoever hosts your domain's DNS, which in South Africa is often 1-grid, xneelo, Afrihost, Domains.co.za or Cloudflare. If your domain uses Microsoft's own nameservers, add them in the admin center under Settings, Domains.

Can you do it for me?

Yes. From any domain report you can request a fix, and a specialist at ITend2end sets up SPF, DKIM and DMARC for a once-off R1,750.