How to Set Up DMARC for Microsoft 365
A step-by-step guide to configuring SPF, DKIM, and DMARC for your Microsoft 365 environment. Protect your organization from domain spoofing and ensure your emails reach their destination.
Get Professional Setup HelpPrerequisites
Before you begin, make sure you have the following:
- Microsoft 365 admin access -- you need the Global Administrator or Exchange Administrator role
- DNS management access -- the ability to create and edit TXT and CNAME records at your domain registrar or DNS provider
- A verified domain in Microsoft 365 -- your custom domain must already be added and verified in the Microsoft 365 admin center
- A list of all email-sending services -- inventory any third-party services that send email on behalf of your domain (marketing platforms, CRM, ticketing systems, etc.)
Step 1: Configure SPF for Microsoft 365
SPF tells receiving mail servers which IP addresses are authorized to send email for your domain. Microsoft 365 requires a specific SPF record to authenticate emails sent through its servers.
Create Your SPF Record
Add a TXT record to your DNS with the following value:
If you use additional email-sending services, add them before the -all directive. For example, if you also use Mailchimp and Salesforce:
Important Notes
- You can only have ONE SPF record per domain. If you already have an SPF record, modify it rather than creating a second one.
- SPF is limited to 10 DNS lookups. Each include: statement counts as one lookup. Exceeding this limit causes SPF to fail entirely.
- Use -all (hard fail) for production. Only use ~all (soft fail) temporarily during testing.
DNS Record Details
Type
TXT
Host/Name
@
TTL
3600
Step 2: Enable DKIM Signing in Microsoft 365
Microsoft 365 supports DKIM signing out of the box, but you need to enable it for your custom domain and publish the DKIM keys in your DNS. By default, Microsoft uses its own domain for DKIM signing, which does not align with your custom domain for DMARC purposes.
Enable DKIM in Microsoft 365 Defender
- 1Go to the Microsoft 365 Defender portal at security.microsoft.com
- 2Navigate to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM
- 3Select your custom domain from the list
- 4Microsoft will display two CNAME records you need to add to your DNS
Add DKIM CNAME Records to DNS
Add these two CNAME records at your DNS provider (replace yourdomain.com with your actual domain):
Record 1
Host: selector1._domainkey
Points to: selector1-yourdomain-com._domainkey.yourdomain.onmicrosoft.com
Record 2
Host: selector2._domainkey
Points to: selector2-yourdomain-com._domainkey.yourdomain.onmicrosoft.com
After DNS Propagation
Wait for DNS propagation (up to 48 hours, but usually under 1 hour), then return to the Microsoft 365 Defender portal and toggle DKIM signing to Enabled for your domain. Microsoft will now sign all outbound emails with your custom domain DKIM key.
Step 3: Publish Your DMARC Record
With SPF and DKIM in place, you can now deploy DMARC. This is the policy layer that tells receiving servers what to do when emails fail authentication and sends you reports about your email traffic.
Start with a Monitoring Policy
Always begin with p=none to monitor your email authentication without impacting delivery. Add this TXT record to your DNS:
DNS Record Details
Type: TXT
Host/Name: _dmarc
TTL: 3600
Record Breakdown
- v=DMARC1 -- protocol version
- p=none -- monitoring only (no action)
- rua= -- address for aggregate reports
- ruf= -- address for forensic reports
- fo=1 -- generate report on any failure
Step 4: Monitor DMARC Reports
Once your DMARC record is live with p=none, receiving servers will start sending you aggregate reports (typically daily). These XML reports show every source sending email using your domain and whether each source passed or failed SPF and DKIM.
What to Look For in Reports
- Legitimate sources passing: Confirm that Microsoft 365 and all your authorized third-party senders show SPF and DKIM pass results.
- Legitimate sources failing: If a service you use is failing, you need to add it to your SPF record or configure DKIM for it before moving to enforcement.
- Unauthorized sources: Look for IPs and domains you do not recognize. These are potential spoofing attempts that DMARC enforcement will block.
Tip: Raw DMARC XML reports are difficult to read manually. Consider using a DMARC reporting tool or service to parse and visualize the data. Monitor for at least 2-4 weeks before progressing to enforcement.
Step 5: Progress to Enforcement
Once you have confirmed all legitimate email sources pass authentication, gradually increase your DMARC enforcement level.
Phase 1: Quarantine 25%
Send 25% of failing emails to spam. Monitor for 1-2 weeks to check for any legitimate email being quarantined.
Phase 2: Quarantine 100%
All failing emails go to spam. Monitor for another 1-2 weeks before moving to reject.
Phase 3: Reject
Full protection. Emails that fail authentication are blocked entirely and never reach the recipient.
Additional Microsoft 365 Security Settings
Beyond DMARC, Microsoft 365 offers additional security features you should configure to maximize protection.
Anti-Phishing Policies
- Enable impersonation protection for key users and domains in Defender
- Turn on mailbox intelligence to learn user email patterns
- Set spoof intelligence to automatically detect and block spoofed senders
Safe Attachments & Links
- Enable Safe Attachments to detonate suspicious files in a sandbox
- Enable Safe Links to scan URLs at time of click
- Configure both policies for internal and external emails
Troubleshooting Common Issues
DKIM toggle will not enable
The CNAME records may not have propagated yet. Wait up to 48 hours and try again. Verify the CNAME records are published correctly using a DNS lookup tool. Ensure there are no typos in the record hostnames or values.
SPF record exceeds 10 lookups
If you have many third-party senders, your SPF record may exceed the 10 DNS lookup limit. Consider using an SPF flattening tool or service, consolidating senders, or using subdomains for different services.
Emails still going to spam after setup
Verify your records using an email authentication testing tool. Check that all sending services are included in your SPF record. Confirm DKIM is signing with your custom domain (not the default Microsoft domain). Review DMARC reports for alignment failures.
Need Help Setting Up Email Security for Microsoft 365?
Our team specializes in configuring email authentication for Microsoft 365 environments. We handle the full setup, monitoring, and enforcement progression so you can focus on your business.
Explore Our Email Security ServicesRelated reading
All postsRelated reading
All postsGet Security Insights Delivered
One email per month with our best articles. No spam.