DMARC for Microsoft 365: setting up your M365 DMARC record

What Microsoft 365 does for you, and what you configure

How much work there is depends on which domain your users send from. Microsoft's DMARC set-up guide (opens in a new tab) splits it into the initial onmicrosoft.com domain, which Microsoft owns, and the custom domains you add yourself:

Two points catch people out. First, Microsoft's DKIM guide (opens in a new tab) says that "currently, no DKIM signing occurs for outbound mail from custom domains" until you set it up, so mail from example.co.uk relies on SPF alone for DMARC until you do. Second, "there are no admin portals or PowerShell cmdlets in Microsoft 365 for you to manage DMARC TXT records in your custom domains": the record lives with whoever hosts your DNS, often your domain registrar.

The onmicrosoft.com records belong to Microsoft, which is also why DMARC platforms treat them differently. Check Point's SPF Management (opens in a new tab) guide, for example, shows a "Not Available" status for onmicrosoft.com subdomains. You can see what any of your domains publishes today with our DMARC checker.

SPF for Exchange Online

For a custom domain that sends only through Microsoft 365, Microsoft's SPF guide (opens in a new tab) gives this record, published as a TXT record at the root of the domain:

The IP address and adatum.com values are Microsoft's own examples; replace them with your real senders. Things to get right:

• One SPF record per domain. Add every sender to the same record rather than publishing a second one
• Hard fail or soft fail. Microsoft recommends -all for Microsoft 365 domains because DMARC and DKIM sit alongside it. gov.uk's Set up government email services securely (opens in a new tab) asks public sector senders for at least ~all. Both count as an SPF failure for DMARC
• The 10-lookup limit. If checking the record needs more than 10 DNS lookups, SPF fails with a permanent error. Each include: costs at least one lookup, and nested includes add more, so fewer than 10 includes does not guarantee you are under the limit
• Subdomains need their own record. The SPF record for example.co.uk does not cover news.example.co.uk
• TTL. Microsoft recommends a TTL of at least 3600 seconds (one hour) on SPF records

The SPF, DKIM and DMARC explained guide covers how SPF alignment works with the Return-Path domain.

DKIM for your custom domain

Microsoft 365 signs with your domain using two CNAME records, called selectors, that point to public keys Microsoft holds. Only one selector is active at a time; the second is there so keys can be rotated. The hostnames are the same for every tenant:

In that format, "example-co-uk" is your custom domain with dashes for dots, the next "example" is the prefix of your onmicrosoft.com domain, and the single letter before -v1 is a partition character Microsoft assigns. The values above are an illustration only: Microsoft says (opens in a new tab) to read the exact values for your domain from the portal or from Exchange Online PowerShell (Get-DkimSigningConfig). To switch DKIM on:

1. In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration, Policies & rules, Threat policies, then the Email authentication settings page and its DKIM tab. This is part of the built-in protection that applies to all cloud mailboxes
2. Select your custom domain and slide the toggle from Disabled to Enabled. An error dialog appears listing the two CNAME values you need, and the status changes to CnameMissing
3. Open the domain's details again and copy the values from the Publish CNAMEs section
4. At your DNS host, create the two CNAME records
5. Wait for Microsoft 365 to detect them (a few minutes, possibly longer), then turn on Sign messages for this domain with DKIM signatures. The status changes to Valid and Rotate DKIM keys becomes available

Repeat this for each custom domain and each subdomain you send from. Once DKIM signs with your domain, DMARC can pass on DKIM even when a message's SPF result breaks, for example after forwarding.

The DMARC record for a Microsoft 365 domain

With SPF and DKIM in place, publish the DMARC record at your DNS host as a TXT record with the host name _dmarc. Start in monitoring mode and send reports to a mailbox or service that can process them:

Microsoft's own examples still include pct=100. RFC 9989 (opens in a new tab), the DMARC standard published in May 2026, made pct historic and added the t tag for testing a stricter policy, which is the t=y row above. t=y is new in RFC 9989: receivers that have not adopted it ignore the tag and apply quarantine in full, so only publish that stage once your reports show every genuine sender passing. Our DMARC generator builds records in the current syntax.

A few Microsoft 365 specifics:

• Where reports go. Microsoft recommends (opens in a new tab) a specific mailbox or Microsoft 365 Group for DMARC reports rather than a user's own mailbox, or an external DMARC reporting service, which then tells you the rua value to use
• Subdomains inherit. Unlike SPF and DKIM, the record at the parent domain covers every subdomain, including ones that do not exist, unless a subdomain publishes its own
• Failure reports. Microsoft 365 does not send DMARC failure (ruf) reports, even if your record asks for them, so most of your insight comes from aggregate reports
• The onmicrosoft.com domain. If you do not send from it, Microsoft says to publish v=DMARC1; p=reject for it too, added on the Domains page of the Microsoft 365 admin center

The DMARC record explained guide covers every tag.

Other services that send as your Microsoft 365 domain

Few organisations send only from Exchange Online. Payroll and HR systems, CRM, accounting software, website forms and marketing platforms often send using your domain, and each one needs SPF or DKIM that aligns with your From address before you move past p=none. Microsoft's guidance offers two practical steps:

• Use subdomains for services you don't control. Microsoft recommends a subdomain such as marketing.example.co.uk for bulk email services, so their problems don't affect the reputation of mail your staff send. It also keeps each SPF record inside its own 10-lookup budget
• Start reporting early. Microsoft's SPF guide says that in complex organisations it is important to "quickly configure DKIM signing and DMARC (in 'take no action' mode)", and that "a DMARC reporting service is very helpful for identifying email sources"

The platforms we supply each connect to Microsoft 365 in their own way:

The DMARC for email marketing platforms guide covers Klaviyo, Mailchimp and Mailgun in detail.

Monitoring and enforcement on Microsoft 365

Once reports arrive, the work is the same as on any platform: identify every sender, fix the ones that fail, then raise the policy. Microsoft's advice for the move to quarantine and reject is to "go slowly and methodically deal with issues that are revealed in DMARC reporting".

Microsoft 365 is also a receiver, and it affects the reports other domains get from you:

• Microsoft 365 sends DMARC aggregate reports to domains with a valid rua address, as long as your MX record points directly to Microsoft 365
• If inbound mail passes through another service or device first (the MX points elsewhere, including hybrid set-ups via an on-premises server), aggregate reports are not sent
• How Microsoft 365 acts on other domains' quarantine and reject policies depends on the Honor DMARC record policy when the message is detected as spoof setting in your anti-phishing policy

For the policy steps themselves, see DMARC policy, and for turning the XML into a list of senders, the DMARC report analyser guide. Mail you send to consumer Outlook.com, Hotmail and Live.com addresses has its own rules for high-volume senders, covered in Gmail, Yahoo and Outlook.com DMARC requirements.

How we help with DMARC on Microsoft 365

Getting a Microsoft 365 domain to enforcement is mostly about the services that send alongside Exchange Online. We can:

• Check your domains: review the SPF, DKIM and DMARC records on your custom domains, subdomains, onmicrosoft.com domain and parked domains
• Set up reporting: point your rua address at a DMARC platform so reports are processed from day one
• Help you choose and supply a platform: EasyDMARC, Valimail or the Check Point DMARC Management add-on, depending on how you work
• Work through your senders with you and plan each policy step to quarantine or reject, at a pace that suits you

EasyDMARC and Valimail licences can be billed monthly, with terms confirmed at quote. Ask us for a quote, or contact us for free advice on your tenant.